Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    198s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:01

General

  • Target

    8ca542a893fa4b8234c0039add4df127785e607bfd325ea9c76d01fd6bc2094a.exe

  • Size

    72KB

  • MD5

    00c53641430b04a6ed81bded46e9bbe3

  • SHA1

    89fc600cc8ca408782f222e74f988f9183888764

  • SHA256

    8ca542a893fa4b8234c0039add4df127785e607bfd325ea9c76d01fd6bc2094a

  • SHA512

    96f32c03aad8bc6111525e4511e61206c793ea9e654b69a5951c468a34fc7c8abb3afb3ccb00f35728739f33b82eb3a6244aab82d3a8b1908124a175686086e7

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf21:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPB

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8ca542a893fa4b8234c0039add4df127785e607bfd325ea9c76d01fd6bc2094a.exe
    "C:\Users\Admin\AppData\Local\Temp\8ca542a893fa4b8234c0039add4df127785e607bfd325ea9c76d01fd6bc2094a.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\3596539098\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3596539098\backup.exe C:\Users\Admin\AppData\Local\Temp\3596539098\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2232
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1304
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4348
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1416
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2556
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1244
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4408
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1084
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2088
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2188
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1960
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:3740
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:32
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2328
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3880
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1828
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3420
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3972
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1104
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2612
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1468
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2428
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4524
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4404
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4292
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4460
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3836
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2336
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:444
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2180
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4820
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4160
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1552
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4892
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Disables RegEdit via registry modification
                    PID:1252
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:4248
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                    9⤵
                    • System policy modification
                    PID:4388
                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4772
                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1128
                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\data.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4400
                • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1476
                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                  8⤵
                    PID:964
                  • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                    8⤵
                      PID:1848
                    • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                      8⤵
                      • Disables RegEdit via registry modification
                      PID:4168
                    • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                      8⤵
                      • System policy modification
                      PID:5044
                    • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                      8⤵
                        PID:1368
                      • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                        8⤵
                          PID:2900
                        • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          PID:3420
                        • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:4112
                        • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                          8⤵
                          • System policy modification
                          PID:764
                        • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:4260
                        • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:2464
                        • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\data.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                          8⤵
                            PID:880
                          • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                            8⤵
                              PID:1452
                            • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:5052
                            • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:5048
                            • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:4436
                            • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                              8⤵
                                PID:1848
                              • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                8⤵
                                  PID:32
                                • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  PID:740
                                • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                  8⤵
                                    PID:1032
                                  • C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-CN\
                                    8⤵
                                      PID:1956
                                    • C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\zh-TW\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      PID:5092
                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2140
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                      8⤵
                                      • Executes dropped EXE
                                      PID:3572
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:1408
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\data.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:4364
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:5112
                                    • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                      8⤵
                                        PID:4436
                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                        8⤵
                                        • Disables RegEdit via registry modification
                                        PID:1816
                                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      PID:1140
                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                        8⤵
                                        • System policy modification
                                        PID:772
                                    • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      PID:3752
                                    • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                      7⤵
                                      • System policy modification
                                      PID:1432
                                    • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                      7⤵
                                        PID:2520
                                      • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:4808
                                        • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:2056
                                      • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                        7⤵
                                          PID:2076
                                          • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                            8⤵
                                            • System policy modification
                                            PID:4996
                                        • C:\Program Files\Common Files\microsoft shared\VC\System Restore.exe
                                          "C:\Program Files\Common Files\microsoft shared\VC\System Restore.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                          7⤵
                                            PID:3348
                                          • C:\Program Files\Common Files\microsoft shared\VGX\update.exe
                                            "C:\Program Files\Common Files\microsoft shared\VGX\update.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:3860
                                          • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                            7⤵
                                            • System policy modification
                                            PID:4832
                                            • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                              8⤵
                                              • System policy modification
                                              PID:5040
                                              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                9⤵
                                                  PID:1860
                                          • C:\Program Files\Common Files\Services\backup.exe
                                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4852
                                          • C:\Program Files\Common Files\System\System Restore.exe
                                            "C:\Program Files\Common Files\System\System Restore.exe" C:\Program Files\Common Files\System\
                                            6⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:4972
                                            • C:\Program Files\Common Files\System\ado\backup.exe
                                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                              7⤵
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              PID:748
                                              • C:\Program Files\Common Files\System\ado\de-DE\update.exe
                                                "C:\Program Files\Common Files\System\ado\de-DE\update.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2516
                                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                8⤵
                                                • Executes dropped EXE
                                                PID:3496
                                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                8⤵
                                                  PID:2004
                                                • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  PID:3284
                                                • C:\Program Files\Common Files\System\ado\it-IT\update.exe
                                                  "C:\Program Files\Common Files\System\ado\it-IT\update.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                  8⤵
                                                    PID:1828
                                                  • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                    8⤵
                                                      PID:3024
                                                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                    7⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:1456
                                                  • C:\Program Files\Common Files\System\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                    7⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:4476
                                                  • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                    7⤵
                                                      PID:2180
                                                    • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                      "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:4928
                                                    • C:\Program Files\Common Files\System\it-IT\update.exe
                                                      "C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\
                                                      7⤵
                                                      • System policy modification
                                                      PID:4332
                                                    • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      • System policy modification
                                                      PID:1124
                                                    • C:\Program Files\Common Files\System\msadc\backup.exe
                                                      "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                      7⤵
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3572
                                                      • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                        8⤵
                                                        • System policy modification
                                                        PID:1564
                                                      • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                        8⤵
                                                          PID:5072
                                                        • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                          8⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:1936
                                                        • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System policy modification
                                                          PID:4036
                                                        • C:\Program Files\Common Files\System\msadc\it-IT\update.exe
                                                          "C:\Program Files\Common Files\System\msadc\it-IT\update.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                          8⤵
                                                            PID:5060
                                                          • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                            "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                            8⤵
                                                              PID:3456
                                                          • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                            "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                            7⤵
                                                            • Drops file in Program Files directory
                                                            PID:4924
                                                            • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              • System policy modification
                                                              PID:1256
                                                            • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                              8⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:4524
                                                            • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:816
                                                            • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                              8⤵
                                                                PID:4284
                                                              • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                8⤵
                                                                  PID:3312
                                                                • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                  8⤵
                                                                    PID:4088
                                                            • C:\Program Files\Google\backup.exe
                                                              "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                              5⤵
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:4708
                                                              • C:\Program Files\Google\Chrome\backup.exe
                                                                "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1248
                                                                • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2940
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • System policy modification
                                                                    PID:1696
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                      9⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5064
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                      9⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:1856
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                      9⤵
                                                                        PID:4572
                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                        9⤵
                                                                          PID:1436
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\System Restore.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                          9⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:3988
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                          9⤵
                                                                            PID:4836
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1044
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                            9⤵
                                                                            • Drops file in Program Files directory
                                                                            PID:1924
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                              10⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:976
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                11⤵
                                                                                • System policy modification
                                                                                PID:4592
                                                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          PID:1732
                                                                  • C:\Program Files\Internet Explorer\backup.exe
                                                                    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                    5⤵
                                                                    • Drops file in Program Files directory
                                                                    PID:2712
                                                                    • C:\Program Files\Internet Explorer\de-DE\update.exe
                                                                      "C:\Program Files\Internet Explorer\de-DE\update.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:3608
                                                                    • C:\Program Files\Internet Explorer\en-US\data.exe
                                                                      "C:\Program Files\Internet Explorer\en-US\data.exe" C:\Program Files\Internet Explorer\en-US\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      PID:2084
                                                                    • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                      6⤵
                                                                        PID:4132
                                                                      • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                        6⤵
                                                                          PID:2016
                                                                        • C:\Program Files\Internet Explorer\images\backup.exe
                                                                          "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                          6⤵
                                                                            PID:2088
                                                                          • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                            "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                            6⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:1464
                                                                          • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                            "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                            6⤵
                                                                              PID:4176
                                                                            • C:\Program Files\Internet Explorer\SIGNUP\data.exe
                                                                              "C:\Program Files\Internet Explorer\SIGNUP\data.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:2704
                                                                          • C:\Program Files\Java\backup.exe
                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                            5⤵
                                                                              PID:3420
                                                                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                6⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Drops file in Program Files directory
                                                                                PID:1972
                                                                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                  7⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:2936
                                                                                • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                  7⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:1684
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                    8⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:2656
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                    8⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:5072
                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                  7⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:1536
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                    8⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:1008
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                      9⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • System policy modification
                                                                                      PID:4164
                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                  7⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Program Files directory
                                                                                  • System policy modification
                                                                                  PID:1356
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                    8⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Program Files directory
                                                                                    • System policy modification
                                                                                    PID:1516
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                      9⤵
                                                                                        PID:4664
                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                        9⤵
                                                                                          PID:4880
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                          9⤵
                                                                                            PID:920
                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                          8⤵
                                                                                            PID:1000
                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe
                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                              9⤵
                                                                                                PID:880
                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                            7⤵
                                                                                              PID:3596
                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                8⤵
                                                                                                  PID:4144
                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                    9⤵
                                                                                                      PID:3616
                                                                                              • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                6⤵
                                                                                                  PID:2948
                                                                                                  • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                    "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                    7⤵
                                                                                                      PID:1660
                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\System Restore.exe
                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\System Restore.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                        8⤵
                                                                                                          PID:1124
                                                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                    5⤵
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:2340
                                                                                                    • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                      "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                      6⤵
                                                                                                        PID:1612
                                                                                                      • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                                        "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                        6⤵
                                                                                                          PID:2924
                                                                                                        • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                          "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                          6⤵
                                                                                                            PID:2364
                                                                                                      • C:\Program Files (x86)\backup.exe
                                                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                        4⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • System policy modification
                                                                                                        PID:1760
                                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                          5⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:720
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                            6⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2760
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                              7⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              • System policy modification
                                                                                                              PID:4268
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\data.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                              7⤵
                                                                                                              • Drops file in Program Files directory
                                                                                                              PID:1236
                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                8⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • System policy modification
                                                                                                                PID:2276
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                  9⤵
                                                                                                                    PID:1412
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                  8⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:3972
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                    9⤵
                                                                                                                      PID:2560
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                    8⤵
                                                                                                                      PID:4292
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                      8⤵
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:3500
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\System Restore.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                        9⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:1900
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                      8⤵
                                                                                                                      • System policy modification
                                                                                                                      PID:4780
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                      8⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      PID:4088
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                      8⤵
                                                                                                                        PID:3944
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\data.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                        8⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:4640
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                          9⤵
                                                                                                                            PID:1100
                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                          8⤵
                                                                                                                            PID:1232
                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                            8⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • System policy modification
                                                                                                                            PID:1184
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                              9⤵
                                                                                                                              • System policy modification
                                                                                                                              PID:3732
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                10⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • System policy modification
                                                                                                                                PID:404
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                              9⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              PID:5044
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                10⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                PID:2336
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                  11⤵
                                                                                                                                  • System policy modification
                                                                                                                                  PID:4052
                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                              9⤵
                                                                                                                                PID:1696
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                  10⤵
                                                                                                                                    PID:2588
                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                  9⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • System policy modification
                                                                                                                                  PID:4032
                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                8⤵
                                                                                                                                  PID:1140
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                    9⤵
                                                                                                                                      PID:3972
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                    8⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:2280
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                    8⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:2056
                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                    8⤵
                                                                                                                                      PID:1876
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                        9⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        PID:1864
                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                                                                          10⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:4132
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                                                                                                            11⤵
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:1300
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                                                                                                              12⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              PID:212
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
                                                                                                                                                13⤵
                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • System policy modification
                                                                                                                                                PID:380
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\update.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
                                                                                                                                                  14⤵
                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                  PID:4100
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\
                                                                                                                                                  14⤵
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:4600
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\
                                                                                                                                              12⤵
                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                              • System policy modification
                                                                                                                                              PID:2504
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\
                                                                                                                                                13⤵
                                                                                                                                                  PID:4172
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
                                                                                                                                                    14⤵
                                                                                                                                                      PID:5104
                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\
                                                                                                                                                11⤵
                                                                                                                                                  PID:4728
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
                                                                                                                                                    12⤵
                                                                                                                                                      PID:1800
                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                            7⤵
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:4564
                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                              8⤵
                                                                                                                                                PID:5100
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                  9⤵
                                                                                                                                                    PID:3132
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                  8⤵
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:2392
                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:1276
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                    9⤵
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    PID:2464
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                      10⤵
                                                                                                                                                        PID:4480
                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                        10⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        PID:4952
                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                          11⤵
                                                                                                                                                            PID:1860
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                            11⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:4572
                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                            11⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:5008
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                    7⤵
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    PID:480
                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System Restore.exe
                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                      8⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:4376
                                                                                                                                              • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                5⤵
                                                                                                                                                  PID:2612
                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                    6⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    PID:536
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                      7⤵
                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                      PID:1520
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                      7⤵
                                                                                                                                                        PID:1568
                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                          8⤵
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:4780
                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe
                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                        7⤵
                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                        PID:2416
                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                          8⤵
                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:4364
                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                        7⤵
                                                                                                                                                          PID:2372
                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                            8⤵
                                                                                                                                                              PID:5056
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                9⤵
                                                                                                                                                                  PID:3556
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                    10⤵
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:4804
                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                    10⤵
                                                                                                                                                                    • System policy modification
                                                                                                                                                                    PID:4800
                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                                                                                      11⤵
                                                                                                                                                                      • System policy modification
                                                                                                                                                                      PID:2640
                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                                                                                      11⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      PID:4928
                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\
                                                                                                                                                                        12⤵
                                                                                                                                                                          PID:1988
                                                                                                                                                            • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                              6⤵
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:4040
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                7⤵
                                                                                                                                                                  PID:764
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:3940
                                                                                                                                                              • C:\Program Files (x86)\Google\update.exe
                                                                                                                                                                "C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                5⤵
                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                PID:4748
                                                                                                                                                                • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:1248
                                                                                                                                                                  • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:5048
                                                                                                                                                                • C:\Users\backup.exe
                                                                                                                                                                  C:\Users\backup.exe C:\Users\
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3988
                                                                                                                                                                    • C:\Users\Admin\backup.exe
                                                                                                                                                                      C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                      5⤵
                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                      PID:2268
                                                                                                                                                                      • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                                                        "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                        6⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        PID:3368
                                                                                                                                                                      • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                        C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:4728
                                                                                                                                                                        • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                          C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          PID:4172
                                                                                                                                                                        • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                          C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                          6⤵
                                                                                                                                                                            PID:2912
                                                                                                                                                                          • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                            C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                            6⤵
                                                                                                                                                                            • System policy modification
                                                                                                                                                                            PID:552
                                                                                                                                                                          • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                            C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                            6⤵
                                                                                                                                                                              PID:4456
                                                                                                                                                                            • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                              C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:1704
                                                                                                                                                                            • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                              C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:2016
                                                                                                                                                                            • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                              C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                              6⤵
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              PID:2004
                                                                                                                                                                            • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                              C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                              6⤵
                                                                                                                                                                                PID:5040
                                                                                                                                                                                • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                                                                  "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                  PID:3836
                                                                                                                                                                                • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                                                                  "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:3684
                                                                                                                                                                                • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                  "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                  6⤵
                                                                                                                                                                                    PID:2932
                                                                                                                                                                                  • C:\Users\Admin\Searches\backup.exe
                                                                                                                                                                                    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                                                                    6⤵
                                                                                                                                                                                      PID:364
                                                                                                                                                                                    • C:\Users\Admin\Videos\backup.exe
                                                                                                                                                                                      C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1608
                                                                                                                                                                                    • C:\Users\Public\backup.exe
                                                                                                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                      5⤵
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      PID:1928
                                                                                                                                                                                      • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:444
                                                                                                                                                                                        • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                          C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1520
                                                                                                                                                                                          • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                            C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:632
                                                                                                                                                                                        • C:\Windows\backup.exe
                                                                                                                                                                                          C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                          4⤵
                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                          PID:4712
                                                                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:3632
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4084
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:1476
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4716
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:676
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4224
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:4244
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:3820
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                                        1⤵
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:3332

                                                                                                                                                                                      Network

                                                                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                      Downloads

                                                                                                                                                                                      • C:\PerfLogs\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3ddf65869955e227c5125591902ad304

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        556f567a23c022dd59fa1b7b244ba304242cfcc2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4e199d125404de38104d26b59103a651953a6658216216c7613e5be559fabdb9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3f647acbef2f8c4fb1e33084f152c026b5a0091b68f4cae7cb326137c929f27074c577742a8d839728f616272ca382ca8cfa20f023bf4770d6b80b38a12e6af3

                                                                                                                                                                                      • C:\PerfLogs\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3ddf65869955e227c5125591902ad304

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        556f567a23c022dd59fa1b7b244ba304242cfcc2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4e199d125404de38104d26b59103a651953a6658216216c7613e5be559fabdb9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3f647acbef2f8c4fb1e33084f152c026b5a0091b68f4cae7cb326137c929f27074c577742a8d839728f616272ca382ca8cfa20f023bf4770d6b80b38a12e6af3

                                                                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        20dd066732e20bf0eb9804079dc75b3e

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a16e0c1f2917bb077e0653471e05704570ec0cb

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        de54f937e8323b517422248b266d85ee6aa971c3b90bea2385d90b61b8600e88

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        532756b016fa4b187bf37f9b00ab7c78d054878da884f70e4464267334ee5d4d520be54cc3a9b96817008698165263231b60b2a75caa827413d80d5240b98b82

                                                                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        20dd066732e20bf0eb9804079dc75b3e

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a16e0c1f2917bb077e0653471e05704570ec0cb

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        de54f937e8323b517422248b266d85ee6aa971c3b90bea2385d90b61b8600e88

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        532756b016fa4b187bf37f9b00ab7c78d054878da884f70e4464267334ee5d4d520be54cc3a9b96817008698165263231b60b2a75caa827413d80d5240b98b82

                                                                                                                                                                                      • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        430136daed1fa63c64b62d0e9c7e1a19

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        11f70727cac58d77ee0433a9be877a02b87db39e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c986a3ce15a93e756cf3fb7926e5449d0a75abaefd4587b8e525ed08bc875c80

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        53bfd73cff21878a629e81596410bb6e5fea50c9ce3ce4ecb3c6b56856bc324dd4f6d5f45c9625675f27df6794b63bcf6feaa39446898d5cbec27d824d73f35c

                                                                                                                                                                                      • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        430136daed1fa63c64b62d0e9c7e1a19

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        11f70727cac58d77ee0433a9be877a02b87db39e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        c986a3ce15a93e756cf3fb7926e5449d0a75abaefd4587b8e525ed08bc875c80

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        53bfd73cff21878a629e81596410bb6e5fea50c9ce3ce4ecb3c6b56856bc324dd4f6d5f45c9625675f27df6794b63bcf6feaa39446898d5cbec27d824d73f35c

                                                                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        7e33dbd49f7d0966eda5c53675e8e47b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a36dd9c7374d441944f49ecc907ac2e02becb1b7

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e89c87884010a5615a91528323db55b95b4427d74e4b1f5b0eb1050dbb4b4d79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c7285e090d2fa2b523b96fec2657e2f4cf2269976c14b50a29a12b984388d8581b7f671f767509dd4d68e7a77f33db009ff937db369ce7c0d9abcabe8be8a100

                                                                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        7e33dbd49f7d0966eda5c53675e8e47b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a36dd9c7374d441944f49ecc907ac2e02becb1b7

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e89c87884010a5615a91528323db55b95b4427d74e4b1f5b0eb1050dbb4b4d79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c7285e090d2fa2b523b96fec2657e2f4cf2269976c14b50a29a12b984388d8581b7f671f767509dd4d68e7a77f33db009ff937db369ce7c0d9abcabe8be8a100

                                                                                                                                                                                      • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b06990c985594edd0ca455d6fb218f62

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        3f9a7b1ff9271bd0371b88987eb1c04c12d751a6

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        cc22d2c1d8ad529a30293c845f5f7ce9cb9f1102723907c20208721ea911a6dd

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4e5bb8e62cf568c8c92c9f33b6b51cdf410397253afb3ea15642d7016d48636a6819011406e29274e4747fc880683be2abccf99b4bd0455ad9ad1f902124d5a7

                                                                                                                                                                                      • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b06990c985594edd0ca455d6fb218f62

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        3f9a7b1ff9271bd0371b88987eb1c04c12d751a6

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        cc22d2c1d8ad529a30293c845f5f7ce9cb9f1102723907c20208721ea911a6dd

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        4e5bb8e62cf568c8c92c9f33b6b51cdf410397253afb3ea15642d7016d48636a6819011406e29274e4747fc880683be2abccf99b4bd0455ad9ad1f902124d5a7

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        a52c1385a3c33b369c179133dca819e6

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c4c91275bff8633fde1ef5f3a83b03477fba5ab5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f61c57c47d51aa3c03afb8262ce91a91d4655c27c91a151ded222a556bc8ab58

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b3cee41c5f08f5ae8aacbf7f5b605cadc0570f49fea18c223e9872ecef5633e3102aa2808909bd9144cbf06112aefed2fccca6d81dca69972993306d144a9b70

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\update.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        a52c1385a3c33b369c179133dca819e6

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c4c91275bff8633fde1ef5f3a83b03477fba5ab5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f61c57c47d51aa3c03afb8262ce91a91d4655c27c91a151ded222a556bc8ab58

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b3cee41c5f08f5ae8aacbf7f5b605cadc0570f49fea18c223e9872ecef5633e3102aa2808909bd9144cbf06112aefed2fccca6d81dca69972993306d144a9b70

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        7e33dbd49f7d0966eda5c53675e8e47b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a36dd9c7374d441944f49ecc907ac2e02becb1b7

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e89c87884010a5615a91528323db55b95b4427d74e4b1f5b0eb1050dbb4b4d79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c7285e090d2fa2b523b96fec2657e2f4cf2269976c14b50a29a12b984388d8581b7f671f767509dd4d68e7a77f33db009ff937db369ce7c0d9abcabe8be8a100

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        7e33dbd49f7d0966eda5c53675e8e47b

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        a36dd9c7374d441944f49ecc907ac2e02becb1b7

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        e89c87884010a5615a91528323db55b95b4427d74e4b1f5b0eb1050dbb4b4d79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        c7285e090d2fa2b523b96fec2657e2f4cf2269976c14b50a29a12b984388d8581b7f671f767509dd4d68e7a77f33db009ff937db369ce7c0d9abcabe8be8a100

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        a52c1385a3c33b369c179133dca819e6

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c4c91275bff8633fde1ef5f3a83b03477fba5ab5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f61c57c47d51aa3c03afb8262ce91a91d4655c27c91a151ded222a556bc8ab58

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b3cee41c5f08f5ae8aacbf7f5b605cadc0570f49fea18c223e9872ecef5633e3102aa2808909bd9144cbf06112aefed2fccca6d81dca69972993306d144a9b70

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        a52c1385a3c33b369c179133dca819e6

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        c4c91275bff8633fde1ef5f3a83b03477fba5ab5

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f61c57c47d51aa3c03afb8262ce91a91d4655c27c91a151ded222a556bc8ab58

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        b3cee41c5f08f5ae8aacbf7f5b605cadc0570f49fea18c223e9872ecef5633e3102aa2808909bd9144cbf06112aefed2fccca6d81dca69972993306d144a9b70

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c592dbd4b125404c2ebf5923f5c2f766

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        bdacf944b47c52d21c00327c38ef8022ea3ec13a

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        034fbd5d905a207265709a3763795a58444133a673b18707103adc534f426bd3

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        cef1c85da6aaeb6c056789f6e7cf6f9c2fa348848e6e8830b4a3030e55aac740ce3a5b5df3ecc09875b7d1a9369b04765c629c3feda5e1945da32c2695ae476b

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\System Restore.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        c55953bebd3bf7da6c408b041ba4cd40

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        914b2c14e9ebf28293834dcbedbe4ea8bbed62fc

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        554613e55bb35a3b7d0d877d01f50e7622c92cd0102629e2e81e4d219de8bbe2

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        574f300d69aebb29e555bcfbc1741fe4e9c4616df6b2d618d2abec69b7da10edde631b834b375d00ccc819143ee1c10c9e7b8f018f04c7451ebd07608926d72c

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        ad1738121dd5a1f8784c196fabfaf55e

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        79169c0f8d07f3cf0256771b80b48c6ea694848c

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        126aef81c54888e1d1001beebe75ab32d69efd675f0efcaf9559ab0c64430d5b

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bdcb4515065f088e58671f71f2d1b56108e2e55c13de080d4c9f70924348d2e310c5e6b98f4782f701496da150afa54fb226997463020359124083ee906898cc

                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        ad1738121dd5a1f8784c196fabfaf55e

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        79169c0f8d07f3cf0256771b80b48c6ea694848c

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        126aef81c54888e1d1001beebe75ab32d69efd675f0efcaf9559ab0c64430d5b

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        bdcb4515065f088e58671f71f2d1b56108e2e55c13de080d4c9f70924348d2e310c5e6b98f4782f701496da150afa54fb226997463020359124083ee906898cc

                                                                                                                                                                                      • C:\Program Files\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3ddf65869955e227c5125591902ad304

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        556f567a23c022dd59fa1b7b244ba304242cfcc2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4e199d125404de38104d26b59103a651953a6658216216c7613e5be559fabdb9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3f647acbef2f8c4fb1e33084f152c026b5a0091b68f4cae7cb326137c929f27074c577742a8d839728f616272ca382ca8cfa20f023bf4770d6b80b38a12e6af3

                                                                                                                                                                                      • C:\Program Files\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3ddf65869955e227c5125591902ad304

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        556f567a23c022dd59fa1b7b244ba304242cfcc2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4e199d125404de38104d26b59103a651953a6658216216c7613e5be559fabdb9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3f647acbef2f8c4fb1e33084f152c026b5a0091b68f4cae7cb326137c929f27074c577742a8d839728f616272ca382ca8cfa20f023bf4770d6b80b38a12e6af3

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3596539098\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b993c8e4f92f64fe3729dc8912bc5684

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        5bd103be87b14076dcea0bd4992d7623ea37461e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        af82ac80fa222b9df303943b4650b58a32f57ab075bb6dec14e84b619e173dc0

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        314fcb2531901d30478e7b1338d71e152879e0313fb743fdd0de1eba72d470c08fb34c8c056b308d7eefeaad19177de7c3bf2cf676528b99938fa321abb28bd4

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\3596539098\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b993c8e4f92f64fe3729dc8912bc5684

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        5bd103be87b14076dcea0bd4992d7623ea37461e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        af82ac80fa222b9df303943b4650b58a32f57ab075bb6dec14e84b619e173dc0

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        314fcb2531901d30478e7b1338d71e152879e0313fb743fdd0de1eba72d470c08fb34c8c056b308d7eefeaad19177de7c3bf2cf676528b99938fa321abb28bd4

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        345823972460d0eb38fcb2ae447a40e3

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a698d77491c8c3352f0c49af8b35a01f3e40162

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        aa1aae0250482fb771e47ede27114e035f6a2ed2f32e4056e0b6e1e6297c0a79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e9ec884c68a11e8ab878dcd899d9ffab6f7eb95bf5b341d3471409c8f2190ad2f58141db7b271acd9e7b450988097412dbd7c0504390661546a2c5c365346e6a

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        345823972460d0eb38fcb2ae447a40e3

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a698d77491c8c3352f0c49af8b35a01f3e40162

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        aa1aae0250482fb771e47ede27114e035f6a2ed2f32e4056e0b6e1e6297c0a79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e9ec884c68a11e8ab878dcd899d9ffab6f7eb95bf5b341d3471409c8f2190ad2f58141db7b271acd9e7b450988097412dbd7c0504390661546a2c5c365346e6a

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        345823972460d0eb38fcb2ae447a40e3

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a698d77491c8c3352f0c49af8b35a01f3e40162

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        aa1aae0250482fb771e47ede27114e035f6a2ed2f32e4056e0b6e1e6297c0a79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e9ec884c68a11e8ab878dcd899d9ffab6f7eb95bf5b341d3471409c8f2190ad2f58141db7b271acd9e7b450988097412dbd7c0504390661546a2c5c365346e6a

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        345823972460d0eb38fcb2ae447a40e3

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a698d77491c8c3352f0c49af8b35a01f3e40162

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        aa1aae0250482fb771e47ede27114e035f6a2ed2f32e4056e0b6e1e6297c0a79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e9ec884c68a11e8ab878dcd899d9ffab6f7eb95bf5b341d3471409c8f2190ad2f58141db7b271acd9e7b450988097412dbd7c0504390661546a2c5c365346e6a

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3164144442d217e28accc1c9dbd68525

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d5f7703c60c1f149abae2bd49507af923b40e928

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        868ed0c7260e3333b487f9fbf75257301becfb69dd282d1e369f6b50898dc3be

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        db95130e903a525f2a173a981454d49e922aa06d4a620b019dac35ab5943e632259d9a44ddd3a3c8b7f998961f89b96cb3cfc0e2a4f5e7804afc089f898b1b2f

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3164144442d217e28accc1c9dbd68525

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d5f7703c60c1f149abae2bd49507af923b40e928

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        868ed0c7260e3333b487f9fbf75257301becfb69dd282d1e369f6b50898dc3be

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        db95130e903a525f2a173a981454d49e922aa06d4a620b019dac35ab5943e632259d9a44ddd3a3c8b7f998961f89b96cb3cfc0e2a4f5e7804afc089f898b1b2f

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b993c8e4f92f64fe3729dc8912bc5684

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        5bd103be87b14076dcea0bd4992d7623ea37461e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        af82ac80fa222b9df303943b4650b58a32f57ab075bb6dec14e84b619e173dc0

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        314fcb2531901d30478e7b1338d71e152879e0313fb743fdd0de1eba72d470c08fb34c8c056b308d7eefeaad19177de7c3bf2cf676528b99938fa321abb28bd4

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        b993c8e4f92f64fe3729dc8912bc5684

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        5bd103be87b14076dcea0bd4992d7623ea37461e

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        af82ac80fa222b9df303943b4650b58a32f57ab075bb6dec14e84b619e173dc0

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        314fcb2531901d30478e7b1338d71e152879e0313fb743fdd0de1eba72d470c08fb34c8c056b308d7eefeaad19177de7c3bf2cf676528b99938fa321abb28bd4

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        345823972460d0eb38fcb2ae447a40e3

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a698d77491c8c3352f0c49af8b35a01f3e40162

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        aa1aae0250482fb771e47ede27114e035f6a2ed2f32e4056e0b6e1e6297c0a79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e9ec884c68a11e8ab878dcd899d9ffab6f7eb95bf5b341d3471409c8f2190ad2f58141db7b271acd9e7b450988097412dbd7c0504390661546a2c5c365346e6a

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        345823972460d0eb38fcb2ae447a40e3

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        9a698d77491c8c3352f0c49af8b35a01f3e40162

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        aa1aae0250482fb771e47ede27114e035f6a2ed2f32e4056e0b6e1e6297c0a79

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        e9ec884c68a11e8ab878dcd899d9ffab6f7eb95bf5b341d3471409c8f2190ad2f58141db7b271acd9e7b450988097412dbd7c0504390661546a2c5c365346e6a

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3164144442d217e28accc1c9dbd68525

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d5f7703c60c1f149abae2bd49507af923b40e928

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        868ed0c7260e3333b487f9fbf75257301becfb69dd282d1e369f6b50898dc3be

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        db95130e903a525f2a173a981454d49e922aa06d4a620b019dac35ab5943e632259d9a44ddd3a3c8b7f998961f89b96cb3cfc0e2a4f5e7804afc089f898b1b2f

                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3164144442d217e28accc1c9dbd68525

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        d5f7703c60c1f149abae2bd49507af923b40e928

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        868ed0c7260e3333b487f9fbf75257301becfb69dd282d1e369f6b50898dc3be

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        db95130e903a525f2a173a981454d49e922aa06d4a620b019dac35ab5943e632259d9a44ddd3a3c8b7f998961f89b96cb3cfc0e2a4f5e7804afc089f898b1b2f

                                                                                                                                                                                      • C:\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        509d084800dab2769670e22c0617ff28

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        2c4be0d4b2df54ec78c55a52dcd64ed180241b5b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f14e6f2dad05e1462a6ce4d61cb11f30357fc02f57258afbe4d47e8f0b37e015

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        aa3bd20384668fc830b384ef252ac6eb1c5822282595526f5556866d41863f8bf207b6d95a4a47357827f50556e9f04f10e65b9b0f7b6e3a69840520c71c3f9a

                                                                                                                                                                                      • C:\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        509d084800dab2769670e22c0617ff28

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        2c4be0d4b2df54ec78c55a52dcd64ed180241b5b

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        f14e6f2dad05e1462a6ce4d61cb11f30357fc02f57258afbe4d47e8f0b37e015

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        aa3bd20384668fc830b384ef252ac6eb1c5822282595526f5556866d41863f8bf207b6d95a4a47357827f50556e9f04f10e65b9b0f7b6e3a69840520c71c3f9a

                                                                                                                                                                                      • C:\odt\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3ddf65869955e227c5125591902ad304

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        556f567a23c022dd59fa1b7b244ba304242cfcc2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4e199d125404de38104d26b59103a651953a6658216216c7613e5be559fabdb9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3f647acbef2f8c4fb1e33084f152c026b5a0091b68f4cae7cb326137c929f27074c577742a8d839728f616272ca382ca8cfa20f023bf4770d6b80b38a12e6af3

                                                                                                                                                                                      • C:\odt\backup.exe

                                                                                                                                                                                        Filesize

                                                                                                                                                                                        72KB

                                                                                                                                                                                        MD5

                                                                                                                                                                                        3ddf65869955e227c5125591902ad304

                                                                                                                                                                                        SHA1

                                                                                                                                                                                        556f567a23c022dd59fa1b7b244ba304242cfcc2

                                                                                                                                                                                        SHA256

                                                                                                                                                                                        4e199d125404de38104d26b59103a651953a6658216216c7613e5be559fabdb9

                                                                                                                                                                                        SHA512

                                                                                                                                                                                        3f647acbef2f8c4fb1e33084f152c026b5a0091b68f4cae7cb326137c929f27074c577742a8d839728f616272ca382ca8cfa20f023bf4770d6b80b38a12e6af3