Analysis
-
max time kernel
155s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
25-11-2022 19:31
General
-
Target
f3a78d5ba5003ea7a6054b423efc973ecd694d177b1658d580c46c94f9647ef7.exe
-
Size
72KB
-
MD5
a79e1c9d00a323fc6b344e69e83cb864
-
SHA1
171b16a6349572ca6dfcd7099bd19b2e7ed464d6
-
SHA256
f3a78d5ba5003ea7a6054b423efc973ecd694d177b1658d580c46c94f9647ef7
-
SHA512
0c268daeade4b6694ceaeda9fcb37574887fe02465b2a298c53ac30a7ba91272cd3521a5df877aea1f938d4977c6f3c0a8dcb0b182d8c1344ed29b90a8c00751
-
SSDEEP
384:N6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oGx:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrE
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 13 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3a78d5ba5003ea7a6054b423efc973ecd694d177b1658d580c46c94f9647ef7.exe"C:\Users\Admin\AppData\Local\Temp\f3a78d5ba5003ea7a6054b423efc973ecd694d177b1658d580c46c94f9647ef7.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1384053283\update.exeC:\Users\Admin\AppData\Local\Temp\1384053283\update.exe C:\Users\Admin\AppData\Local\Temp\1384053283\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\9⤵
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\9⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\9⤵
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\update.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\9⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\8⤵
-
C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\8⤵
-
C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\8⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\8⤵
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\Source Engine\System Restore.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\System Restore.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
-
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
-
C:\Program Files\Common Files\microsoft shared\Triedit\System Restore.exe"C:\Program Files\Common Files\microsoft shared\Triedit\System Restore.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵
-
C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\8⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\VC\backup.exe"C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\7⤵
- System policy modification
-
C:\Program Files\Common Files\microsoft shared\VGX\backup.exe"C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\7⤵
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- System policy modification
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Internet Explorer\de-DE\update.exe"C:\Program Files\Internet Explorer\de-DE\update.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- System policy modification
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Internet Explorer\es-ES\data.exe"C:\Program Files\Internet Explorer\es-ES\data.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Internet Explorer\fr-FR\update.exe"C:\Program Files\Internet Explorer\fr-FR\update.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
- System policy modification
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
- System policy modification
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.8.0_66\backup.exe"C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\6⤵
- Drops file in Program Files directory
-
C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\7⤵
-
C:\Program Files\Java\jdk1.8.0_66\db\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe"C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\8⤵
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\8⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\9⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\10⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\9⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\10⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\9⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\10⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\9⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\9⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\8⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\9⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\10⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\9⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\9⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\10⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\10⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\11⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\update.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\8⤵
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
-
C:\Program Files (x86)\Common Files\Adobe\ARM\data.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\data.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\8⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\7⤵
-
C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\8⤵
-
C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\8⤵
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\10⤵
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\update.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\update.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\10⤵
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\11⤵
-
C:\Program Files (x86)\Common Files\Java\backup.exe"C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe"C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\7⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\update.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\fr-FR\8⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
-
C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSEnv\PublicAssemblies\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\System Restore.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
-
C:\Program Files (x86)\Common Files\System\ado\backup.exe"C:\Program Files (x86)\Common Files\System\ado\backup.exe" C:\Program Files (x86)\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe"C:\Program Files (x86)\Common Files\System\ado\de-DE\backup.exe" C:\Program Files (x86)\Common Files\System\ado\de-DE\8⤵
-
C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe"C:\Program Files (x86)\Common Files\System\ado\en-US\backup.exe" C:\Program Files (x86)\Common Files\System\ado\en-US\8⤵
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Google\CrashReports\update.exe"C:\Program Files (x86)\Google\CrashReports\update.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵
- System policy modification
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵
-
C:\Program Files (x86)\Google\Update\backup.exe"C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe"C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\7⤵
-
C:\Program Files (x86)\Google\Update\Download\backup.exe"C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\7⤵
- System policy modification
-
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\8⤵
-
C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe"C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\89.0.4389.114\9⤵
-
C:\Program Files (x86)\Google\Update\Install\backup.exe"C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\7⤵
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe"C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\6⤵
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe"C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\6⤵
-
C:\Program Files (x86)\Internet Explorer\images\backup.exe"C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\6⤵
-
C:\Program Files (x86)\Internet Explorer\it-IT\update.exe"C:\Program Files (x86)\Internet Explorer\it-IT\update.exe" C:\Program Files (x86)\Internet Explorer\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe"C:\Program Files (x86)\Internet Explorer\ja-JP\backup.exe" C:\Program Files (x86)\Internet Explorer\ja-JP\6⤵
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe"C:\Program Files (x86)\Internet Explorer\SIGNUP\backup.exe" C:\Program Files (x86)\Internet Explorer\SIGNUP\6⤵
-
C:\Program Files (x86)\Microsoft\backup.exe"C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\backup.exe"C:\Program Files (x86)\Microsoft\Edge\backup.exe" C:\Program Files (x86)\Microsoft\Edge\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\backup.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\8⤵
- System policy modification
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\System Restore.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\System Restore.exe" C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\9⤵
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
-
C:\Users\Admin\OneDrive\backup.exeC:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\6⤵
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- System policy modification
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
- System policy modification
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵
- System policy modification
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
-
C:\Windows\appcompat\backup.exeC:\Windows\appcompat\backup.exe C:\Windows\appcompat\5⤵
- Drops file in Windows directory
- System policy modification
-
C:\Windows\appcompat\appraiser\backup.exeC:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\6⤵
- Drops file in Windows directory
-
C:\Windows\appcompat\appraiser\Telemetry\backup.exeC:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\7⤵
-
C:\Windows\appcompat\encapsulation\backup.exeC:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\6⤵
-
C:\Windows\appcompat\Programs\backup.exeC:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\apppatch\backup.exeC:\Windows\apppatch\backup.exe C:\Windows\apppatch\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
- System policy modification
-
C:\Windows\apppatch\AppPatch64\backup.exeC:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\6⤵
-
C:\Windows\apppatch\Custom\update.exeC:\Windows\apppatch\Custom\update.exe C:\Windows\apppatch\Custom\6⤵
- Drops file in Windows directory
-
C:\Windows\apppatch\Custom\Custom64\backup.exeC:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Windows\apppatch\CustomSDB\backup.exeC:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\6⤵
-
C:\Windows\apppatch\de-DE\backup.exeC:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\6⤵
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\1⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\1⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\System Restore.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\1⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\backup.exeFilesize
72KB
MD56d57cb6c2d3d07f6c70ab0f39b6868a7
SHA1cf6fdd99463b81e027919838cd875af62dcddb8e
SHA25659d23ccb753e2f84bb97c1db0589f0e9e615b2a6ce48a91cf4592d2b75d7fe43
SHA512ea6434c6def8a9480762972abb391d146d88353d38e5f673f20abe688599659479be33e5148713d679b0e82443952af2562f8909bf9f77ddb8b959e23df0125c
-
C:\PerfLogs\backup.exeFilesize
72KB
MD56d57cb6c2d3d07f6c70ab0f39b6868a7
SHA1cf6fdd99463b81e027919838cd875af62dcddb8e
SHA25659d23ccb753e2f84bb97c1db0589f0e9e615b2a6ce48a91cf4592d2b75d7fe43
SHA512ea6434c6def8a9480762972abb391d146d88353d38e5f673f20abe688599659479be33e5148713d679b0e82443952af2562f8909bf9f77ddb8b959e23df0125c
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exeFilesize
72KB
MD560eb7ed6983bc5e22bcf40342e01b607
SHA17355cea2fd935d4f1e13afb3a6131a8da698f3b5
SHA25692e15edec7cbf3379c43e271e09ec67cf475d7a9bf8a3ed39fd280097a67b385
SHA512952981149c7d3bba5e76bc9bc919df9eb13bc9e98e11ed071be4d4d95866e227f040478f8470343618fabf430ad1740955fb53552a66b8a53ae8869a9e437c4e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exeFilesize
72KB
MD560eb7ed6983bc5e22bcf40342e01b607
SHA17355cea2fd935d4f1e13afb3a6131a8da698f3b5
SHA25692e15edec7cbf3379c43e271e09ec67cf475d7a9bf8a3ed39fd280097a67b385
SHA512952981149c7d3bba5e76bc9bc919df9eb13bc9e98e11ed071be4d4d95866e227f040478f8470343618fabf430ad1740955fb53552a66b8a53ae8869a9e437c4e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exeFilesize
72KB
MD5663da0d8ceef014cdee26bf3f82a23b3
SHA1428c452213f2cbb2322cdab4ae83a033643b3188
SHA2565e1aba1ce2a8cbbaf8e152dec2795a285d93791a9b262fd11dd9a320997bfa7c
SHA512305f8ebe49057c7bb874cf72a058f1965eeacf1ca024a379fc5807dbed82560ec6bb7eb70c05d953b97491864d7502582766a9fe32d619bde5d606eb7be21d99
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exeFilesize
72KB
MD5663da0d8ceef014cdee26bf3f82a23b3
SHA1428c452213f2cbb2322cdab4ae83a033643b3188
SHA2565e1aba1ce2a8cbbaf8e152dec2795a285d93791a9b262fd11dd9a320997bfa7c
SHA512305f8ebe49057c7bb874cf72a058f1965eeacf1ca024a379fc5807dbed82560ec6bb7eb70c05d953b97491864d7502582766a9fe32d619bde5d606eb7be21d99
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exeFilesize
72KB
MD50d68c58af72641ec2546f6a46a22cde7
SHA196559a4ee3f40003a1f454766045ce56a55844af
SHA2562de6dbd76f383e95cc97b9f2b5f399d599f6b8c68c2b0ad7a6dd2ae3547333e4
SHA512b2ebc30dccfb1b412d27a4fa77cc9679a5b1f9b9e975c07dbd1f60e63c686bd5da15752d463dc9d0fddab8001e5f2258fabcfcf8f896921fd442a7bdc09ef20a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exeFilesize
72KB
MD50d68c58af72641ec2546f6a46a22cde7
SHA196559a4ee3f40003a1f454766045ce56a55844af
SHA2562de6dbd76f383e95cc97b9f2b5f399d599f6b8c68c2b0ad7a6dd2ae3547333e4
SHA512b2ebc30dccfb1b412d27a4fa77cc9679a5b1f9b9e975c07dbd1f60e63c686bd5da15752d463dc9d0fddab8001e5f2258fabcfcf8f896921fd442a7bdc09ef20a
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exeFilesize
72KB
MD5cd7adf3227ee189bbb2fd6c9a529af35
SHA1a6bfec8d0e7dbfa0636191c35f822b548916495d
SHA256454417ba25890f16d784af991127532a683b51aae50e73bf0677113f28abb68b
SHA512e5549c85a170f956f482264ac0c5cc4180bfed5ced1bdcf24c689f024984c91137b64c00a858e0f5ead4d3029fd5fbb9b9b1e43e3682724a81b02d89aba7a078
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exeFilesize
72KB
MD5cd7adf3227ee189bbb2fd6c9a529af35
SHA1a6bfec8d0e7dbfa0636191c35f822b548916495d
SHA256454417ba25890f16d784af991127532a683b51aae50e73bf0677113f28abb68b
SHA512e5549c85a170f956f482264ac0c5cc4180bfed5ced1bdcf24c689f024984c91137b64c00a858e0f5ead4d3029fd5fbb9b9b1e43e3682724a81b02d89aba7a078
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exeFilesize
72KB
MD5ef0436e42f09dddd8e62ba2c017eb022
SHA1af5b97aff4e576347c7b79a765ca8a1ad4d73ed9
SHA2565d69e48187e99d2934e54fba6a254f86879d65d41eaafdd1677b1c917461a36a
SHA5128d79f6f221f0c300e201e9fb7f27ce562c0a84365a46c27e148a0fc09a50842826293bd0ca7abeb58428a85b19fcdb6c4cb7dab1024b5b39516be1c9ae9641e3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exeFilesize
72KB
MD5ef0436e42f09dddd8e62ba2c017eb022
SHA1af5b97aff4e576347c7b79a765ca8a1ad4d73ed9
SHA2565d69e48187e99d2934e54fba6a254f86879d65d41eaafdd1677b1c917461a36a
SHA5128d79f6f221f0c300e201e9fb7f27ce562c0a84365a46c27e148a0fc09a50842826293bd0ca7abeb58428a85b19fcdb6c4cb7dab1024b5b39516be1c9ae9641e3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exeFilesize
72KB
MD5f5e744ca8f6f78917f3ef3fb33ea31a1
SHA15386b2c8a339156d855d75cba801263035d52684
SHA25689050c1450f1d3075a6939ab7c124fe9fba2808d4049680b22aabf86494c77a1
SHA5126f8b50afe8162b34f2b28232a9956f3e488e4f7b244b0a3e352879b6db9e5b989453b8f3b7fb5bf4f73a076a13f8d28380eda8f6bb919c669c90851528085495
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exeFilesize
72KB
MD5f5e744ca8f6f78917f3ef3fb33ea31a1
SHA15386b2c8a339156d855d75cba801263035d52684
SHA25689050c1450f1d3075a6939ab7c124fe9fba2808d4049680b22aabf86494c77a1
SHA5126f8b50afe8162b34f2b28232a9956f3e488e4f7b244b0a3e352879b6db9e5b989453b8f3b7fb5bf4f73a076a13f8d28380eda8f6bb919c669c90851528085495
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exeFilesize
72KB
MD5ef0436e42f09dddd8e62ba2c017eb022
SHA1af5b97aff4e576347c7b79a765ca8a1ad4d73ed9
SHA2565d69e48187e99d2934e54fba6a254f86879d65d41eaafdd1677b1c917461a36a
SHA5128d79f6f221f0c300e201e9fb7f27ce562c0a84365a46c27e148a0fc09a50842826293bd0ca7abeb58428a85b19fcdb6c4cb7dab1024b5b39516be1c9ae9641e3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exeFilesize
72KB
MD5ef0436e42f09dddd8e62ba2c017eb022
SHA1af5b97aff4e576347c7b79a765ca8a1ad4d73ed9
SHA2565d69e48187e99d2934e54fba6a254f86879d65d41eaafdd1677b1c917461a36a
SHA5128d79f6f221f0c300e201e9fb7f27ce562c0a84365a46c27e148a0fc09a50842826293bd0ca7abeb58428a85b19fcdb6c4cb7dab1024b5b39516be1c9ae9641e3
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exeFilesize
72KB
MD560eb7ed6983bc5e22bcf40342e01b607
SHA17355cea2fd935d4f1e13afb3a6131a8da698f3b5
SHA25692e15edec7cbf3379c43e271e09ec67cf475d7a9bf8a3ed39fd280097a67b385
SHA512952981149c7d3bba5e76bc9bc919df9eb13bc9e98e11ed071be4d4d95866e227f040478f8470343618fabf430ad1740955fb53552a66b8a53ae8869a9e437c4e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exeFilesize
72KB
MD560eb7ed6983bc5e22bcf40342e01b607
SHA17355cea2fd935d4f1e13afb3a6131a8da698f3b5
SHA25692e15edec7cbf3379c43e271e09ec67cf475d7a9bf8a3ed39fd280097a67b385
SHA512952981149c7d3bba5e76bc9bc919df9eb13bc9e98e11ed071be4d4d95866e227f040478f8470343618fabf430ad1740955fb53552a66b8a53ae8869a9e437c4e
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exeFilesize
72KB
MD5df6a8d0de6c484a53ba0485be9842bed
SHA1b454fb6c470d8c552a074db198ed9748833b3035
SHA256d4327dde2f02f06fa143e411566211d2641eff1112ca1d0c6eef0545e26f0869
SHA512247467967dccdee7723679fbd05537ebf0d7de1d256009d60f6e0039971fe7c029a2e3af87d764754b9e106007c20c95f54f843b073d1fbe7d796a7721cb2d4d
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exeFilesize
72KB
MD5df6a8d0de6c484a53ba0485be9842bed
SHA1b454fb6c470d8c552a074db198ed9748833b3035
SHA256d4327dde2f02f06fa143e411566211d2641eff1112ca1d0c6eef0545e26f0869
SHA512247467967dccdee7723679fbd05537ebf0d7de1d256009d60f6e0039971fe7c029a2e3af87d764754b9e106007c20c95f54f843b073d1fbe7d796a7721cb2d4d
-
C:\Program Files (x86)\Adobe\backup.exeFilesize
72KB
MD59fe6d8d9b2498c2a06050e4122a264d8
SHA1f54cc5b297b9885860e0d26798919c96105a2f90
SHA2568a9703b89574e2b7a0b1af25dbb1176b74a5af7f3cdb22853fb3f8e2556b1afe
SHA512f06a8893b75ab716c016a6f28e0fc362b26e0212179f425946d31c7842e82246eb6704e5413df7d69cbf7bae8f3942604a8a2ab34f38aaee09decdf35bfff3b5
-
C:\Program Files (x86)\Adobe\backup.exeFilesize
72KB
MD59fe6d8d9b2498c2a06050e4122a264d8
SHA1f54cc5b297b9885860e0d26798919c96105a2f90
SHA2568a9703b89574e2b7a0b1af25dbb1176b74a5af7f3cdb22853fb3f8e2556b1afe
SHA512f06a8893b75ab716c016a6f28e0fc362b26e0212179f425946d31c7842e82246eb6704e5413df7d69cbf7bae8f3942604a8a2ab34f38aaee09decdf35bfff3b5
-
C:\Program Files (x86)\backup.exeFilesize
72KB
MD5a42c0fb5e532921d342dac2371305caa
SHA1b7e9da145a0ea0eb13f924d968c5765bd3ffc6b5
SHA256bf89c42102c66222803628ff254513d037bc91a5618250abb609794de70da907
SHA5123848548aec973bb3120e59ae695fb0b98b303b7b0ecdb6a074da57d68a327702cea606ca9b89da86e7affce0bc40e8cfc06511d8114a7533a0eddc3721354b42
-
C:\Program Files (x86)\backup.exeFilesize
72KB
MD5a42c0fb5e532921d342dac2371305caa
SHA1b7e9da145a0ea0eb13f924d968c5765bd3ffc6b5
SHA256bf89c42102c66222803628ff254513d037bc91a5618250abb609794de70da907
SHA5123848548aec973bb3120e59ae695fb0b98b303b7b0ecdb6a074da57d68a327702cea606ca9b89da86e7affce0bc40e8cfc06511d8114a7533a0eddc3721354b42
-
C:\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD56f769a1ce08f2395ed0b50cfec448081
SHA14ba53576dfdd95f8e7109faa294a154fc40e0448
SHA2561257ec60733bc6099bf7b1a7a45c9cebb897b81de433c71a1407279c6bba5387
SHA51276c2b6f09bbe8b8cb40e62d89b2a3427febb9ae143382be1ddcf1b93cbc9504c062a0fb5210ecff2b4d32d418fc7ea0897f918f9ea7bcd89e14b2c27afc2e9d1
-
C:\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD56f769a1ce08f2395ed0b50cfec448081
SHA14ba53576dfdd95f8e7109faa294a154fc40e0448
SHA2561257ec60733bc6099bf7b1a7a45c9cebb897b81de433c71a1407279c6bba5387
SHA51276c2b6f09bbe8b8cb40e62d89b2a3427febb9ae143382be1ddcf1b93cbc9504c062a0fb5210ecff2b4d32d418fc7ea0897f918f9ea7bcd89e14b2c27afc2e9d1
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD544184122d7d1a55b9b9b8fbc22c7cfcb
SHA1c501e5532f94b9ebba4f4a774edc72049d69dabb
SHA25678952138e578a1d8fc1031c585043172240d53ce140fccfc289f6ce507a818b5
SHA51261a9e36e049307b8476610a134c2ba2b3dc0cca510ce7b5caed94f55a4230adfed92f6d61ad3cf625a7c48ebce345f16ac8a69ad2d5e4adf6032e5351ac61dd2
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD544184122d7d1a55b9b9b8fbc22c7cfcb
SHA1c501e5532f94b9ebba4f4a774edc72049d69dabb
SHA25678952138e578a1d8fc1031c585043172240d53ce140fccfc289f6ce507a818b5
SHA51261a9e36e049307b8476610a134c2ba2b3dc0cca510ce7b5caed94f55a4230adfed92f6d61ad3cf625a7c48ebce345f16ac8a69ad2d5e4adf6032e5351ac61dd2
-
C:\Program Files\Common Files\DESIGNER\backup.exeFilesize
72KB
MD59ea7cba2026d53afac49a2bc9e91679f
SHA1c29891d2540ce60b634307b3057ae0f6a28ac97d
SHA25626ce55810ded93212700f88e8ff55ba0cc4c47f4060874d06ea638141f6b4435
SHA5128d50d190ae922c68b4ea471385b60cdbfb51c8e4a998b58d5897628ab777494d36f8770e6df21e5317c368270a13c73523cfc2b27a15d19412acf1bd1a9613c0
-
C:\Program Files\Common Files\DESIGNER\backup.exeFilesize
72KB
MD59ea7cba2026d53afac49a2bc9e91679f
SHA1c29891d2540ce60b634307b3057ae0f6a28ac97d
SHA25626ce55810ded93212700f88e8ff55ba0cc4c47f4060874d06ea638141f6b4435
SHA5128d50d190ae922c68b4ea471385b60cdbfb51c8e4a998b58d5897628ab777494d36f8770e6df21e5317c368270a13c73523cfc2b27a15d19412acf1bd1a9613c0
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5a6a33bbcfd3fdf0dcfd7b15dded5beb0
SHA17576f3aa91009c8307d661cc4d49410a6a1f221a
SHA2561b32185e58d8c371fd5f6d518a24da64c8a9068bc472ba54dfca0074df53694d
SHA512244f8039cc192d73955f1e9f2f023edf2edd055a1b8675c7d638cd01586bd2cf990bcc108ae9abdb258539769c7c58945234ce59ee8410d7f276e8cb53711157
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5a6a33bbcfd3fdf0dcfd7b15dded5beb0
SHA17576f3aa91009c8307d661cc4d49410a6a1f221a
SHA2561b32185e58d8c371fd5f6d518a24da64c8a9068bc472ba54dfca0074df53694d
SHA512244f8039cc192d73955f1e9f2f023edf2edd055a1b8675c7d638cd01586bd2cf990bcc108ae9abdb258539769c7c58945234ce59ee8410d7f276e8cb53711157
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exeFilesize
72KB
MD54abce3519530961b3efabac9669372e7
SHA10da61447ff59cdbb286b32a5354b7da5e37b4291
SHA2560c79f983c610e2e4ecd7f372a307eeadef5b6dc2aa9aa9f2790b1e0512aeb5c8
SHA51258bc5406629dc9360fd58f7c54dbea748b9a66f37f49242b445db53fdb739bf4bc850613df6884ac4fc9b30b0ec316f617043d668ce05fe09c680315d87fb629
-
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exeFilesize
72KB
MD54abce3519530961b3efabac9669372e7
SHA10da61447ff59cdbb286b32a5354b7da5e37b4291
SHA2560c79f983c610e2e4ecd7f372a307eeadef5b6dc2aa9aa9f2790b1e0512aeb5c8
SHA51258bc5406629dc9360fd58f7c54dbea748b9a66f37f49242b445db53fdb739bf4bc850613df6884ac4fc9b30b0ec316f617043d668ce05fe09c680315d87fb629
-
C:\Program Files\Common Files\microsoft shared\backup.exeFilesize
72KB
MD59ea7cba2026d53afac49a2bc9e91679f
SHA1c29891d2540ce60b634307b3057ae0f6a28ac97d
SHA25626ce55810ded93212700f88e8ff55ba0cc4c47f4060874d06ea638141f6b4435
SHA5128d50d190ae922c68b4ea471385b60cdbfb51c8e4a998b58d5897628ab777494d36f8770e6df21e5317c368270a13c73523cfc2b27a15d19412acf1bd1a9613c0
-
C:\Program Files\Common Files\microsoft shared\backup.exeFilesize
72KB
MD59ea7cba2026d53afac49a2bc9e91679f
SHA1c29891d2540ce60b634307b3057ae0f6a28ac97d
SHA25626ce55810ded93212700f88e8ff55ba0cc4c47f4060874d06ea638141f6b4435
SHA5128d50d190ae922c68b4ea471385b60cdbfb51c8e4a998b58d5897628ab777494d36f8770e6df21e5317c368270a13c73523cfc2b27a15d19412acf1bd1a9613c0
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exeFilesize
72KB
MD54b88abef0e11e8ffa0d33122bc90cf91
SHA1ec1e742c8809e4a00069976efa005f3c52e95df9
SHA256944177df5bbfe49793b14471f63af7877b67631201dba490cdc1e6cfd0811e58
SHA5125ad3a46bce38ee6da7f812a264d1ea6c038eee986fe5cf67400972ab6b81d9a747b1739890af691e83fb5cbad97034df1bc9e2957ecf72a080eae7b74139c83b
-
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exeFilesize
72KB
MD54b88abef0e11e8ffa0d33122bc90cf91
SHA1ec1e742c8809e4a00069976efa005f3c52e95df9
SHA256944177df5bbfe49793b14471f63af7877b67631201dba490cdc1e6cfd0811e58
SHA5125ad3a46bce38ee6da7f812a264d1ea6c038eee986fe5cf67400972ab6b81d9a747b1739890af691e83fb5cbad97034df1bc9e2957ecf72a080eae7b74139c83b
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exeFilesize
72KB
MD51980fb27cbaa0dd54d6ed6cc7ce7527a
SHA155eb2d0a07acbe711ceb7077f6e4bc33c13cc449
SHA2566659d4b99263ccfa201ebda09118e3f81c1a699be82bea3457a763e8051132f5
SHA5123e36c3fcc90ce286f365b7a55898724d87e82bbc7b16ee154d066e938b0d3eb17b0560b48f03dbabc463e1c982da761902ee252ec7e09a63a0b6c5f335014a59
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exeFilesize
72KB
MD51980fb27cbaa0dd54d6ed6cc7ce7527a
SHA155eb2d0a07acbe711ceb7077f6e4bc33c13cc449
SHA2566659d4b99263ccfa201ebda09118e3f81c1a699be82bea3457a763e8051132f5
SHA5123e36c3fcc90ce286f365b7a55898724d87e82bbc7b16ee154d066e938b0d3eb17b0560b48f03dbabc463e1c982da761902ee252ec7e09a63a0b6c5f335014a59
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exeFilesize
72KB
MD5a22fda3f9d536fdf633ad177f4a976fb
SHA18312eab365b0c26f17d5c6c5827b149afc836281
SHA256a79c7ab65d830b711cd88ceb12ff987cf3847bf89f05ae5a9b5a2921f3deae53
SHA5120243d316cdd0bd1b3fd36149d1e7dcc21ea441f6b5e6b895f8a594ee31dfc8d7d2b83039dabec49fbcdf257caa2ae04ac2f714bf7567e906160093781bbd0dec
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exeFilesize
72KB
MD5a22fda3f9d536fdf633ad177f4a976fb
SHA18312eab365b0c26f17d5c6c5827b149afc836281
SHA256a79c7ab65d830b711cd88ceb12ff987cf3847bf89f05ae5a9b5a2921f3deae53
SHA5120243d316cdd0bd1b3fd36149d1e7dcc21ea441f6b5e6b895f8a594ee31dfc8d7d2b83039dabec49fbcdf257caa2ae04ac2f714bf7567e906160093781bbd0dec
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exeFilesize
72KB
MD5a22fda3f9d536fdf633ad177f4a976fb
SHA18312eab365b0c26f17d5c6c5827b149afc836281
SHA256a79c7ab65d830b711cd88ceb12ff987cf3847bf89f05ae5a9b5a2921f3deae53
SHA5120243d316cdd0bd1b3fd36149d1e7dcc21ea441f6b5e6b895f8a594ee31dfc8d7d2b83039dabec49fbcdf257caa2ae04ac2f714bf7567e906160093781bbd0dec
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exeFilesize
72KB
MD5a22fda3f9d536fdf633ad177f4a976fb
SHA18312eab365b0c26f17d5c6c5827b149afc836281
SHA256a79c7ab65d830b711cd88ceb12ff987cf3847bf89f05ae5a9b5a2921f3deae53
SHA5120243d316cdd0bd1b3fd36149d1e7dcc21ea441f6b5e6b895f8a594ee31dfc8d7d2b83039dabec49fbcdf257caa2ae04ac2f714bf7567e906160093781bbd0dec
-
C:\Program Files\backup.exeFilesize
72KB
MD56d57cb6c2d3d07f6c70ab0f39b6868a7
SHA1cf6fdd99463b81e027919838cd875af62dcddb8e
SHA25659d23ccb753e2f84bb97c1db0589f0e9e615b2a6ce48a91cf4592d2b75d7fe43
SHA512ea6434c6def8a9480762972abb391d146d88353d38e5f673f20abe688599659479be33e5148713d679b0e82443952af2562f8909bf9f77ddb8b959e23df0125c
-
C:\Program Files\backup.exeFilesize
72KB
MD56d57cb6c2d3d07f6c70ab0f39b6868a7
SHA1cf6fdd99463b81e027919838cd875af62dcddb8e
SHA25659d23ccb753e2f84bb97c1db0589f0e9e615b2a6ce48a91cf4592d2b75d7fe43
SHA512ea6434c6def8a9480762972abb391d146d88353d38e5f673f20abe688599659479be33e5148713d679b0e82443952af2562f8909bf9f77ddb8b959e23df0125c
-
C:\Users\Admin\AppData\Local\Temp\1384053283\update.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\1384053283\update.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD59719a2c23c517a2f7adc6014f83758bf
SHA1cef783624d7a44b923941f66e452c16ad2f44291
SHA25653f6b40a10849eddaabcc936f2e2d41033458eab74eee613843468f3543301a1
SHA512e8eba79faa4a3239d94beb6678e1ab33c912b1ded80f02c8c07adb7c42459f5541c5684a237dc68b08cc7f39d1e20621a682222cf3580b099288ecf54c975fec
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD59719a2c23c517a2f7adc6014f83758bf
SHA1cef783624d7a44b923941f66e452c16ad2f44291
SHA25653f6b40a10849eddaabcc936f2e2d41033458eab74eee613843468f3543301a1
SHA512e8eba79faa4a3239d94beb6678e1ab33c912b1ded80f02c8c07adb7c42459f5541c5684a237dc68b08cc7f39d1e20621a682222cf3580b099288ecf54c975fec
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5e3c27452aa2e7688309a24e69d83f04c
SHA1677ab0a9a289a68f984318a9850f75a7b6480646
SHA256cc3ab720d4d2c57f9522467de1be2e20b04e6c0c4b72f3af6442a0d64f1baa0d
SHA512312f69edd8ed728eb33dbb8321a8e944023a381ccde7d4bd167d6bedd967a462ffbd4839d6c62e259283b6dd9ba85f57b559ee5ceee83d1d6f0ac2b0883e630c
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD59719a2c23c517a2f7adc6014f83758bf
SHA1cef783624d7a44b923941f66e452c16ad2f44291
SHA25653f6b40a10849eddaabcc936f2e2d41033458eab74eee613843468f3543301a1
SHA512e8eba79faa4a3239d94beb6678e1ab33c912b1ded80f02c8c07adb7c42459f5541c5684a237dc68b08cc7f39d1e20621a682222cf3580b099288ecf54c975fec
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD59719a2c23c517a2f7adc6014f83758bf
SHA1cef783624d7a44b923941f66e452c16ad2f44291
SHA25653f6b40a10849eddaabcc936f2e2d41033458eab74eee613843468f3543301a1
SHA512e8eba79faa4a3239d94beb6678e1ab33c912b1ded80f02c8c07adb7c42459f5541c5684a237dc68b08cc7f39d1e20621a682222cf3580b099288ecf54c975fec
-
C:\backup.exeFilesize
72KB
MD5e6ff2a4c091d3fb55f098096fa4959df
SHA1ec4869f4cc2586db8870a1a274ded524b2abcaa1
SHA256e7a568fdad6f7a07e4cc40dc074e68ef6a0cf93eafcff0686f50bcf96fc7c8fe
SHA512e1aec6441de3d6c6bab97c2bf3b5053b4713e0b414e95cf72c6d22a25436f4935a646dfca8a3ecba60839e4d279e69825b5430f69a583fd4c8ae4f62b42c2635
-
C:\backup.exeFilesize
72KB
MD5e6ff2a4c091d3fb55f098096fa4959df
SHA1ec4869f4cc2586db8870a1a274ded524b2abcaa1
SHA256e7a568fdad6f7a07e4cc40dc074e68ef6a0cf93eafcff0686f50bcf96fc7c8fe
SHA512e1aec6441de3d6c6bab97c2bf3b5053b4713e0b414e95cf72c6d22a25436f4935a646dfca8a3ecba60839e4d279e69825b5430f69a583fd4c8ae4f62b42c2635
-
C:\odt\backup.exeFilesize
72KB
MD5f45cdb8a2a3f4f10a44d4af2e683d589
SHA189bac0f3528f77aa87f452c2d957cc0242e189e2
SHA256d7c24602f036539ae2155eab864c01a7b3895c4ac2934a9ec261e4b97a18f65e
SHA5126af19143f1f8410402c7021b3ccbfd6cf9313be04d103ca43454de0e2bec37a294e651d645d16365ab2a00c2295aef250c9b3267d25c056a87d443e55fce6ae6
-
C:\odt\backup.exeFilesize
72KB
MD5f45cdb8a2a3f4f10a44d4af2e683d589
SHA189bac0f3528f77aa87f452c2d957cc0242e189e2
SHA256d7c24602f036539ae2155eab864c01a7b3895c4ac2934a9ec261e4b97a18f65e
SHA5126af19143f1f8410402c7021b3ccbfd6cf9313be04d103ca43454de0e2bec37a294e651d645d16365ab2a00c2295aef250c9b3267d25c056a87d443e55fce6ae6
-
memory/508-370-0x0000000000000000-mapping.dmp
-
memory/728-274-0x0000000000000000-mapping.dmp
-
memory/884-209-0x0000000000000000-mapping.dmp
-
memory/1020-144-0x0000000000000000-mapping.dmp
-
memory/1208-303-0x0000000000000000-mapping.dmp
-
memory/1408-368-0x0000000000000000-mapping.dmp
-
memory/1464-282-0x0000000000000000-mapping.dmp
-
memory/1488-279-0x0000000000000000-mapping.dmp
-
memory/1508-324-0x0000000000000000-mapping.dmp
-
memory/1520-234-0x0000000000000000-mapping.dmp
-
memory/1532-364-0x0000000000000000-mapping.dmp
-
memory/1544-352-0x0000000000000000-mapping.dmp
-
memory/1576-363-0x0000000000000000-mapping.dmp
-
memory/1592-318-0x0000000000000000-mapping.dmp
-
memory/1716-179-0x0000000000000000-mapping.dmp
-
memory/1732-340-0x0000000000000000-mapping.dmp
-
memory/1972-369-0x0000000000000000-mapping.dmp
-
memory/1976-249-0x0000000000000000-mapping.dmp
-
memory/2000-327-0x0000000000000000-mapping.dmp
-
memory/2004-350-0x0000000000000000-mapping.dmp
-
memory/2028-242-0x0000000000000000-mapping.dmp
-
memory/2040-289-0x0000000000000000-mapping.dmp
-
memory/2124-159-0x0000000000000000-mapping.dmp
-
memory/2136-184-0x0000000000000000-mapping.dmp
-
memory/2160-295-0x0000000000000000-mapping.dmp
-
memory/2164-333-0x0000000000000000-mapping.dmp
-
memory/2192-164-0x0000000000000000-mapping.dmp
-
memory/2388-314-0x0000000000000000-mapping.dmp
-
memory/2816-264-0x0000000000000000-mapping.dmp
-
memory/2848-219-0x0000000000000000-mapping.dmp
-
memory/2884-339-0x0000000000000000-mapping.dmp
-
memory/3524-307-0x0000000000000000-mapping.dmp
-
memory/3600-200-0x0000000000000000-mapping.dmp
-
memory/3624-365-0x0000000000000000-mapping.dmp
-
memory/3748-189-0x0000000000000000-mapping.dmp
-
memory/3812-239-0x0000000000000000-mapping.dmp
-
memory/3916-366-0x0000000000000000-mapping.dmp
-
memory/3924-212-0x0000000000000000-mapping.dmp
-
memory/3980-169-0x0000000000000000-mapping.dmp
-
memory/4136-300-0x0000000000000000-mapping.dmp
-
memory/4172-134-0x0000000000000000-mapping.dmp
-
memory/4244-229-0x0000000000000000-mapping.dmp
-
memory/4252-257-0x0000000000000000-mapping.dmp
-
memory/4320-194-0x0000000000000000-mapping.dmp
-
memory/4328-154-0x0000000000000000-mapping.dmp
-
memory/4376-199-0x0000000000000000-mapping.dmp
-
memory/4384-349-0x0000000000000000-mapping.dmp
-
memory/4408-345-0x0000000000000000-mapping.dmp
-
memory/4488-312-0x0000000000000000-mapping.dmp
-
memory/4524-351-0x0000000000000000-mapping.dmp
-
memory/4576-348-0x0000000000000000-mapping.dmp
-
memory/4652-224-0x0000000000000000-mapping.dmp
-
memory/4664-174-0x0000000000000000-mapping.dmp
-
memory/4720-321-0x0000000000000000-mapping.dmp
-
memory/4796-267-0x0000000000000000-mapping.dmp
-
memory/4812-254-0x0000000000000000-mapping.dmp
-
memory/4844-294-0x0000000000000000-mapping.dmp
-
memory/4892-367-0x0000000000000000-mapping.dmp
-
memory/4980-306-0x0000000000000000-mapping.dmp
-
memory/5048-371-0x0000000000000000-mapping.dmp
-
memory/5068-334-0x0000000000000000-mapping.dmp
-
memory/5068-149-0x0000000000000000-mapping.dmp
-
memory/5104-139-0x0000000000000000-mapping.dmp
-
memory/5104-330-0x0000000000000000-mapping.dmp