Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    196s
  • max time network
    202s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:09

General

  • Target

    68465c52bf8a470fdcb806e0977bc25fc28ce3f7dcd26fa87047ab4d339532fb.exe

  • Size

    72KB

  • MD5

    01d6b38dc1b0db873a43778a0f73eb54

  • SHA1

    068e084e3a4e1e4bb3d1705dae94bc8a3a3fe2cf

  • SHA256

    68465c52bf8a470fdcb806e0977bc25fc28ce3f7dcd26fa87047ab4d339532fb

  • SHA512

    4b910e7781322dba226589b4da301f89203730364dde1dd1c74e7aea2fa5ba92f1f5905e5bebb8dbf97c304143abae24610cb77c3197d6c3c43c33e361cc3e9e

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf27:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPv

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\68465c52bf8a470fdcb806e0977bc25fc28ce3f7dcd26fa87047ab4d339532fb.exe
    "C:\Users\Admin\AppData\Local\Temp\68465c52bf8a470fdcb806e0977bc25fc28ce3f7dcd26fa87047ab4d339532fb.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Users\Admin\AppData\Local\Temp\3075311536\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3075311536\backup.exe C:\Users\Admin\AppData\Local\Temp\3075311536\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4972
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1288
        • C:\odt\System Restore.exe
          "C:\odt\System Restore.exe" C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1512
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1392
        • C:\Program Files\update.exe
          "C:\Program Files\update.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2468
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1304
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:116
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1844
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4584
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3828
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1048
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1856
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4012
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4160
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1808
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2808
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2280
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2144
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2060
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4568
                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                    9⤵
                      PID:4216
                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                        10⤵
                          PID:4276
                    • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                      8⤵
                      • Executes dropped EXE
                      • System policy modification
                      PID:2348
                    • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:4832
                    • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1412
                    • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                      8⤵
                        PID:3972
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Drops file in Program Files directory
                        • System policy modification
                        PID:2820
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\System Restore.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                          9⤵
                            PID:764
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                            9⤵
                            • System policy modification
                            PID:1388
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:1124
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                            9⤵
                            • Disables RegEdit via registry modification
                            PID:4560
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:1984
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                            9⤵
                            • Disables RegEdit via registry modification
                            • System policy modification
                            PID:4364
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                            9⤵
                              PID:4864
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                              9⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:4936
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                              9⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:3968
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                              9⤵
                                PID:4184
                            • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                              8⤵
                                PID:3736
                              • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                                8⤵
                                  PID:736
                                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                                  8⤵
                                  • System policy modification
                                  PID:4928
                                • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  PID:2112
                                • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  PID:1516
                                • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                                  8⤵
                                    PID:3840
                                  • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • System policy modification
                                    PID:4548
                                  • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                                    8⤵
                                      PID:1108
                                    • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                      8⤵
                                        PID:4484
                                      • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                                        8⤵
                                        • Disables RegEdit via registry modification
                                        PID:448
                                      • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                        8⤵
                                          PID:1676
                                        • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                                          8⤵
                                            PID:1664
                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                          7⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1700
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2840
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:2204
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                            8⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1980
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\data.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                            8⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:2428
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                            8⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1876
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1736
                                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                          7⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1296
                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                            8⤵
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3900
                                        • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                          7⤵
                                            PID:204
                                          • C:\Program Files\Common Files\microsoft shared\Source Engine\update.exe
                                            "C:\Program Files\Common Files\microsoft shared\Source Engine\update.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                            7⤵
                                              PID:3700
                                            • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System policy modification
                                              PID:1152
                                            • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                              7⤵
                                              • Drops file in Program Files directory
                                              PID:3776
                                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                8⤵
                                                  PID:4320
                                              • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                                7⤵
                                                • System policy modification
                                                PID:3068
                                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                  8⤵
                                                  • System policy modification
                                                  PID:2652
                                              • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:544
                                              • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                7⤵
                                                  PID:1836
                                                • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                  7⤵
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:3896
                                                  • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1252
                                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                      9⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System policy modification
                                                      PID:4920
                                              • C:\Program Files\Common Files\Services\backup.exe
                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                6⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:3592
                                              • C:\Program Files\Common Files\System\backup.exe
                                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4404
                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                  7⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1776
                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1056
                                                  • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:5008
                                                  • C:\Program Files\Common Files\System\ado\es-ES\data.exe
                                                    "C:\Program Files\Common Files\System\ado\es-ES\data.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3936
                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                      9⤵
                                                      • System policy modification
                                                      PID:1076
                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\data.exe
                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                        10⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        PID:1296
                                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                    8⤵
                                                      PID:1252
                                                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                      8⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:4068
                                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:5112
                                                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                    7⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    PID:2232
                                                  • C:\Program Files\Common Files\System\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                    7⤵
                                                      PID:3128
                                                    • C:\Program Files\Common Files\System\es-ES\System Restore.exe
                                                      "C:\Program Files\Common Files\System\es-ES\System Restore.exe" C:\Program Files\Common Files\System\es-ES\
                                                      7⤵
                                                      • System policy modification
                                                      PID:3008
                                                    • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                      "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • System policy modification
                                                      PID:2676
                                                    • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      PID:2276
                                                    • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                      "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                      7⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:400
                                                    • C:\Program Files\Common Files\System\msadc\System Restore.exe
                                                      "C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\
                                                      7⤵
                                                      • Drops file in Program Files directory
                                                      PID:4416
                                                      • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                        8⤵
                                                          PID:792
                                                        • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                          "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                          8⤵
                                                            PID:1056
                                                          • C:\Program Files\Common Files\System\msadc\fr-FR\data.exe
                                                            "C:\Program Files\Common Files\System\msadc\fr-FR\data.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                            8⤵
                                                              PID:3952
                                                            • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              PID:4912
                                                            • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                              8⤵
                                                                PID:2648
                                                              • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:992
                                                            • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                              7⤵
                                                              • Drops file in Program Files directory
                                                              PID:2332
                                                              • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                8⤵
                                                                • System policy modification
                                                                PID:3664
                                                              • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                8⤵
                                                                  PID:3656
                                                                • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • System policy modification
                                                                  PID:3068
                                                                • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:1932
                                                                • C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\de-DE\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • System policy modification
                                                                  PID:4660
                                                                • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:3084
                                                          • C:\Program Files\Google\data.exe
                                                            "C:\Program Files\Google\data.exe" C:\Program Files\Google\
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:964
                                                            • C:\Program Files\Google\Chrome\backup.exe
                                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                              6⤵
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:752
                                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2292
                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2008
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                    9⤵
                                                                      PID:3896
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                      9⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:3180
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                      9⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4064
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                      9⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:1676
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                      9⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      PID:1392
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                      9⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:3784
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                      9⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:3724
                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe
                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                      9⤵
                                                                      • Disables RegEdit via registry modification
                                                                      • System policy modification
                                                                      PID:1224
                                                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                    8⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:1652
                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                              5⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Drops file in Program Files directory
                                                              PID:1104
                                                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System policy modification
                                                                PID:5032
                                                              • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:2464
                                                              • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                6⤵
                                                                  PID:2576
                                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  • System policy modification
                                                                  PID:1548
                                                                • C:\Program Files\Internet Explorer\images\backup.exe
                                                                  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:1636
                                                                • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                  "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4940
                                                                • C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe
                                                                  "C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                  6⤵
                                                                  • System policy modification
                                                                  PID:3660
                                                                • C:\Program Files\Internet Explorer\ja-JP\System Restore.exe
                                                                  "C:\Program Files\Internet Explorer\ja-JP\System Restore.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  • System policy modification
                                                                  PID:316
                                                              • C:\Program Files\Java\backup.exe
                                                                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                5⤵
                                                                  PID:4872
                                                                  • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                    6⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • Drops file in Program Files directory
                                                                    PID:2128
                                                                    • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                      7⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:1220
                                                                    • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      PID:4172
                                                                      • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                        8⤵
                                                                          PID:556
                                                                        • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          PID:3844
                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                        7⤵
                                                                        • System policy modification
                                                                        PID:4836
                                                                        • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                          "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System policy modification
                                                                          PID:4204
                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                        7⤵
                                                                          PID:3472
                                                                      • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                        "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                        6⤵
                                                                          PID:4024
                                                                      • C:\Program Files\Microsoft Office\backup.exe
                                                                        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                        5⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • System policy modification
                                                                        PID:3168
                                                                    • C:\Program Files (x86)\backup.exe
                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                      4⤵
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1060
                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:2584
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5012
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                            7⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1416
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:2360
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3576
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                9⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1620
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4340
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                9⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:528
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                              8⤵
                                                                              • Disables RegEdit via registry modification
                                                                              PID:3500
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                              8⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Drops file in Program Files directory
                                                                              • System policy modification
                                                                              PID:4796
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:3852
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                              8⤵
                                                                                PID:1804
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:2840
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                8⤵
                                                                                  PID:1068
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                  8⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:1584
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                    9⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • System policy modification
                                                                                    PID:1716
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                  8⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:2768
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                  8⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:4724
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                    9⤵
                                                                                    • System policy modification
                                                                                    PID:4564
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                      10⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:1784
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:4108
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                      10⤵
                                                                                      • Drops file in Program Files directory
                                                                                      • System policy modification
                                                                                      PID:1432
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                        11⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System policy modification
                                                                                        PID:2512
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                    9⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:4200
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                      10⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:3508
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                    9⤵
                                                                                      PID:3116
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                    8⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Program Files directory
                                                                                    PID:3704
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                      9⤵
                                                                                        PID:1504
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                      8⤵
                                                                                        PID:1828
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                        8⤵
                                                                                        • Drops file in Program Files directory
                                                                                        • System policy modification
                                                                                        PID:3532
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                          9⤵
                                                                                          • Disables RegEdit via registry modification
                                                                                          PID:1992
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                            10⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:3936
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\
                                                                                              11⤵
                                                                                                PID:4392
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                          8⤵
                                                                                            PID:4424
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                          7⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:1156
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:3944
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                              9⤵
                                                                                              • System policy modification
                                                                                              PID:364
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\data.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                            8⤵
                                                                                              PID:2828
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\data.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                              8⤵
                                                                                                PID:4352
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                  9⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:1632
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                    10⤵
                                                                                                      PID:520
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                      10⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • Drops file in Program Files directory
                                                                                                      PID:3284
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                        11⤵
                                                                                                          PID:3100
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                  7⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  • System policy modification
                                                                                                  PID:4412
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                    8⤵
                                                                                                      PID:1680
                                                                                              • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                5⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:4064
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                  6⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:32
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                    7⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • System policy modification
                                                                                                    PID:1152
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                    7⤵
                                                                                                      PID:1928
                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\data.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\data.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                        8⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        • System policy modification
                                                                                                        PID:2076
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                      7⤵
                                                                                                        PID:2204
                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                          8⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:4752
                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                        7⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        • System policy modification
                                                                                                        PID:4568
                                                                                                    • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                      6⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • System policy modification
                                                                                                      PID:3512
                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                      6⤵
                                                                                                        PID:2660
                                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                      5⤵
                                                                                                        PID:2068
                                                                                                    • C:\Users\backup.exe
                                                                                                      C:\Users\backup.exe C:\Users\
                                                                                                      4⤵
                                                                                                        PID:4932
                                                                                                        • C:\Users\Admin\backup.exe
                                                                                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                          5⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          PID:2232
                                                                                                          • C:\Users\Admin\3D Objects\backup.exe
                                                                                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:3008
                                                                                                          • C:\Users\Admin\Desktop\backup.exe
                                                                                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                            6⤵
                                                                                                              PID:3724
                                                                                                            • C:\Users\Admin\Documents\backup.exe
                                                                                                              C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                              6⤵
                                                                                                                PID:4612
                                                                                                              • C:\Users\Admin\Contacts\backup.exe
                                                                                                                C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                6⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:4232
                                                                                                              • C:\Users\Admin\Downloads\backup.exe
                                                                                                                C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                6⤵
                                                                                                                  PID:1448
                                                                                                                • C:\Users\Admin\Links\backup.exe
                                                                                                                  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:972
                                                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                  6⤵
                                                                                                                    PID:2428
                                                                                                                  • C:\Users\Admin\Music\backup.exe
                                                                                                                    C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                    6⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:1452
                                                                                                                • C:\Users\Public\backup.exe
                                                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                  5⤵
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  PID:4652
                                                                                                              • C:\Windows\backup.exe
                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                4⤵
                                                                                                                • System policy modification
                                                                                                                PID:428
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4924
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                            2⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4868
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4224
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                            2⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1600
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4444
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                            2⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:516
                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                          1⤵
                                                                                                            PID:1828
                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                              2⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:2672
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                            1⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • System policy modification
                                                                                                            PID:2856
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                            1⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:3116

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a7c49f085bcd12529d21385de4910e57

                                                                                                            SHA1

                                                                                                            a1829b3549c13a3d48a5e4aaea6151498ba44f66

                                                                                                            SHA256

                                                                                                            9ac0a6818bc13f27069dbfdf77795f1d814df4f05d1af97f194a644de3d59f40

                                                                                                            SHA512

                                                                                                            5cf639309b74d16bcf28c093e74a2d8340bebad0d57ffe47b2ae878395e45e5bf617dc034366cd4c78f16cc1dc7f3d60114122d9336a453a4e0e11e24fea4ec6

                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a7c49f085bcd12529d21385de4910e57

                                                                                                            SHA1

                                                                                                            a1829b3549c13a3d48a5e4aaea6151498ba44f66

                                                                                                            SHA256

                                                                                                            9ac0a6818bc13f27069dbfdf77795f1d814df4f05d1af97f194a644de3d59f40

                                                                                                            SHA512

                                                                                                            5cf639309b74d16bcf28c093e74a2d8340bebad0d57ffe47b2ae878395e45e5bf617dc034366cd4c78f16cc1dc7f3d60114122d9336a453a4e0e11e24fea4ec6

                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a612c6e340808dc46b032eba2414b9b3

                                                                                                            SHA1

                                                                                                            0bee65d363ea929f36d156010ab3397302c1f1c1

                                                                                                            SHA256

                                                                                                            332614c8212fe8efaf30dbf64df06868a7562576f38807a6f1e86539e4057978

                                                                                                            SHA512

                                                                                                            52f2b82cc259f3fea7b73cf0dfea6d3ba56cd7fcf1cdf282178648c907e442081f1a5a5a3570284139c5bc6307abe5775aea22612fe10fe0e5e84d4cec598235

                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            0dba327d46aa5c6631436c64a33ad25c

                                                                                                            SHA1

                                                                                                            ac37068e627504d9634f8f26c0ca2aca58606253

                                                                                                            SHA256

                                                                                                            ec47f4ab4b130d796824fc3129f0d5e3d5d9b56881adfd70294b0ee905d88390

                                                                                                            SHA512

                                                                                                            290c07d8c6487054236bd0b4c7ff2d723d4398042e6826d4949d038cf2eec4809be7f15804ecd0d2715b9acf626d2a1a784f92680bff8e374a41d35c05833efe

                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            0dba327d46aa5c6631436c64a33ad25c

                                                                                                            SHA1

                                                                                                            ac37068e627504d9634f8f26c0ca2aca58606253

                                                                                                            SHA256

                                                                                                            ec47f4ab4b130d796824fc3129f0d5e3d5d9b56881adfd70294b0ee905d88390

                                                                                                            SHA512

                                                                                                            290c07d8c6487054236bd0b4c7ff2d723d4398042e6826d4949d038cf2eec4809be7f15804ecd0d2715b9acf626d2a1a784f92680bff8e374a41d35c05833efe

                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3dc109075aef1467deeefc36e052214e

                                                                                                            SHA1

                                                                                                            e029506a9b5d9f35c223adba7cdb95c36c3090b3

                                                                                                            SHA256

                                                                                                            cb542e2b21560de9f2ccd1563e0e94de0c777548e420101f03c4f558441a4f57

                                                                                                            SHA512

                                                                                                            a50d2439f137be02bd0bb2c151798ee6d32f83a1a4f160e7871153ba08156dbbca784965f5f4a6a9bf4b7eb4f49f4d48495f5b366b04ad94746c56e892226d77

                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3dc109075aef1467deeefc36e052214e

                                                                                                            SHA1

                                                                                                            e029506a9b5d9f35c223adba7cdb95c36c3090b3

                                                                                                            SHA256

                                                                                                            cb542e2b21560de9f2ccd1563e0e94de0c777548e420101f03c4f558441a4f57

                                                                                                            SHA512

                                                                                                            a50d2439f137be02bd0bb2c151798ee6d32f83a1a4f160e7871153ba08156dbbca784965f5f4a6a9bf4b7eb4f49f4d48495f5b366b04ad94746c56e892226d77

                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a5695c6156197aec6dc677494c02058c

                                                                                                            SHA1

                                                                                                            abe4c12da4e078b6c3f4c415d1d920388250e0b5

                                                                                                            SHA256

                                                                                                            912da10cf4abd666fbbf6c37d785e29cce8fdcc4ed889c65f6a9af3dec680a65

                                                                                                            SHA512

                                                                                                            698834991288ba0a41eb69455f33191cb570d57b85bd04b77a1a2d4aa8443ac40e60ced8acfbe7901d1f4524b8cea16f9db93705d01682a5d41a3f148afb0a66

                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a5695c6156197aec6dc677494c02058c

                                                                                                            SHA1

                                                                                                            abe4c12da4e078b6c3f4c415d1d920388250e0b5

                                                                                                            SHA256

                                                                                                            912da10cf4abd666fbbf6c37d785e29cce8fdcc4ed889c65f6a9af3dec680a65

                                                                                                            SHA512

                                                                                                            698834991288ba0a41eb69455f33191cb570d57b85bd04b77a1a2d4aa8443ac40e60ced8acfbe7901d1f4524b8cea16f9db93705d01682a5d41a3f148afb0a66

                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            ad9eac61671467b79a31eb62521608c1

                                                                                                            SHA1

                                                                                                            0232dbf5b28153383a2ad5926b2be1bcd9aafbed

                                                                                                            SHA256

                                                                                                            e3e68b84a7aab631907ee2fbbb73a431aa4d17e27f8ee0fd5256cb87d71b477f

                                                                                                            SHA512

                                                                                                            c47ef349e59a1b051c5eae27185e1ce0cc39975f5cb32001f3d46b8f3af26333be7a17a7f43a628d0f8e3aab2443243b5c3d1bde7363d67273fa8c909e15ee4c

                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            ad9eac61671467b79a31eb62521608c1

                                                                                                            SHA1

                                                                                                            0232dbf5b28153383a2ad5926b2be1bcd9aafbed

                                                                                                            SHA256

                                                                                                            e3e68b84a7aab631907ee2fbbb73a431aa4d17e27f8ee0fd5256cb87d71b477f

                                                                                                            SHA512

                                                                                                            c47ef349e59a1b051c5eae27185e1ce0cc39975f5cb32001f3d46b8f3af26333be7a17a7f43a628d0f8e3aab2443243b5c3d1bde7363d67273fa8c909e15ee4c

                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a5695c6156197aec6dc677494c02058c

                                                                                                            SHA1

                                                                                                            abe4c12da4e078b6c3f4c415d1d920388250e0b5

                                                                                                            SHA256

                                                                                                            912da10cf4abd666fbbf6c37d785e29cce8fdcc4ed889c65f6a9af3dec680a65

                                                                                                            SHA512

                                                                                                            698834991288ba0a41eb69455f33191cb570d57b85bd04b77a1a2d4aa8443ac40e60ced8acfbe7901d1f4524b8cea16f9db93705d01682a5d41a3f148afb0a66

                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a5695c6156197aec6dc677494c02058c

                                                                                                            SHA1

                                                                                                            abe4c12da4e078b6c3f4c415d1d920388250e0b5

                                                                                                            SHA256

                                                                                                            912da10cf4abd666fbbf6c37d785e29cce8fdcc4ed889c65f6a9af3dec680a65

                                                                                                            SHA512

                                                                                                            698834991288ba0a41eb69455f33191cb570d57b85bd04b77a1a2d4aa8443ac40e60ced8acfbe7901d1f4524b8cea16f9db93705d01682a5d41a3f148afb0a66

                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            8c92b0a0bb0278359640167bdc5a46e9

                                                                                                            SHA1

                                                                                                            c7b76abd066e824141cf0b4dc05ce6fdf147feba

                                                                                                            SHA256

                                                                                                            78ad9176f9020e8064918661a9230a2f66927c454e5b2642a5984808aa946451

                                                                                                            SHA512

                                                                                                            7f18c13f738a211236c3721e23a201c8a113e51e67b6b4251217765153713c75ddc1bd463b781dd6b648792bed577446cf3b55e14e38c73578446c97a6e46efc

                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            8c92b0a0bb0278359640167bdc5a46e9

                                                                                                            SHA1

                                                                                                            c7b76abd066e824141cf0b4dc05ce6fdf147feba

                                                                                                            SHA256

                                                                                                            78ad9176f9020e8064918661a9230a2f66927c454e5b2642a5984808aa946451

                                                                                                            SHA512

                                                                                                            7f18c13f738a211236c3721e23a201c8a113e51e67b6b4251217765153713c75ddc1bd463b781dd6b648792bed577446cf3b55e14e38c73578446c97a6e46efc

                                                                                                          • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            dd7fd02a59e92533a43d8f11de60d867

                                                                                                            SHA1

                                                                                                            82eeee467fa5500d00f30ab3cf3eb6352745393f

                                                                                                            SHA256

                                                                                                            984feafd55694b0cc801b19634cb4688579921f4c4ee541a0726498870c23b53

                                                                                                            SHA512

                                                                                                            42bad3ce0a87df71405358f421fcf0d5a66b0da5a8c350fafe93c8cd687b0bee7a1e06bbb073c292351b4da3d63cecee6174b31d4e71f27cc4cecb48940f9d48

                                                                                                          • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            dd7fd02a59e92533a43d8f11de60d867

                                                                                                            SHA1

                                                                                                            82eeee467fa5500d00f30ab3cf3eb6352745393f

                                                                                                            SHA256

                                                                                                            984feafd55694b0cc801b19634cb4688579921f4c4ee541a0726498870c23b53

                                                                                                            SHA512

                                                                                                            42bad3ce0a87df71405358f421fcf0d5a66b0da5a8c350fafe93c8cd687b0bee7a1e06bbb073c292351b4da3d63cecee6174b31d4e71f27cc4cecb48940f9d48

                                                                                                          • C:\Program Files\Common Files\System\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            fde1c531dfbdd81fbe46520a72e7c62c

                                                                                                            SHA1

                                                                                                            87714ea7740155d712e6b3745da4fb79101bb038

                                                                                                            SHA256

                                                                                                            dca554f607f2edb1bf3efd63e75f4908087db17f7864e696baeacd3cc962d78d

                                                                                                            SHA512

                                                                                                            a87e3876afab62b4e3b94e5cf993e64f0e89306334ef888179d093e2e35d527bbe639c8fdc644b1bc6b410d709a910a898c263a7f988783d42e77a6c14311f43

                                                                                                          • C:\Program Files\Common Files\System\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            fde1c531dfbdd81fbe46520a72e7c62c

                                                                                                            SHA1

                                                                                                            87714ea7740155d712e6b3745da4fb79101bb038

                                                                                                            SHA256

                                                                                                            dca554f607f2edb1bf3efd63e75f4908087db17f7864e696baeacd3cc962d78d

                                                                                                            SHA512

                                                                                                            a87e3876afab62b4e3b94e5cf993e64f0e89306334ef888179d093e2e35d527bbe639c8fdc644b1bc6b410d709a910a898c263a7f988783d42e77a6c14311f43

                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            ad9eac61671467b79a31eb62521608c1

                                                                                                            SHA1

                                                                                                            0232dbf5b28153383a2ad5926b2be1bcd9aafbed

                                                                                                            SHA256

                                                                                                            e3e68b84a7aab631907ee2fbbb73a431aa4d17e27f8ee0fd5256cb87d71b477f

                                                                                                            SHA512

                                                                                                            c47ef349e59a1b051c5eae27185e1ce0cc39975f5cb32001f3d46b8f3af26333be7a17a7f43a628d0f8e3aab2443243b5c3d1bde7363d67273fa8c909e15ee4c

                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            ad9eac61671467b79a31eb62521608c1

                                                                                                            SHA1

                                                                                                            0232dbf5b28153383a2ad5926b2be1bcd9aafbed

                                                                                                            SHA256

                                                                                                            e3e68b84a7aab631907ee2fbbb73a431aa4d17e27f8ee0fd5256cb87d71b477f

                                                                                                            SHA512

                                                                                                            c47ef349e59a1b051c5eae27185e1ce0cc39975f5cb32001f3d46b8f3af26333be7a17a7f43a628d0f8e3aab2443243b5c3d1bde7363d67273fa8c909e15ee4c

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            04ec99ff906eea7bc3b903438e0e6954

                                                                                                            SHA1

                                                                                                            4cf08776a5cfd222da48b4eac3353f39b4374444

                                                                                                            SHA256

                                                                                                            e3779162cae1006bb814496f7bc27e5ab5628a98b5a859612bfc719f501f1989

                                                                                                            SHA512

                                                                                                            13fc3bf0b91d0e50e192a8648dfc6d353847e589999c9f9538a26cb311d5e126868a08effcf788b704dea80c68957d586fc57ecba8f026b20264ea1ec975ecfd

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            04ec99ff906eea7bc3b903438e0e6954

                                                                                                            SHA1

                                                                                                            4cf08776a5cfd222da48b4eac3353f39b4374444

                                                                                                            SHA256

                                                                                                            e3779162cae1006bb814496f7bc27e5ab5628a98b5a859612bfc719f501f1989

                                                                                                            SHA512

                                                                                                            13fc3bf0b91d0e50e192a8648dfc6d353847e589999c9f9538a26cb311d5e126868a08effcf788b704dea80c68957d586fc57ecba8f026b20264ea1ec975ecfd

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            fb278cc2851a917c889e94458999368d

                                                                                                            SHA1

                                                                                                            293cf290cf9cb8e110eefa3c836405dfa8822d4e

                                                                                                            SHA256

                                                                                                            29058b70fad785cd0c1e23c32e7b6c32211899e714719d530c43e4c4a2786125

                                                                                                            SHA512

                                                                                                            4e5027b0935fcfab798b8db616d7be4fdc2a283f660494867b1669606f45cec003986cdbe6740597849bd61b0e95106bfb6380af8f7798fceb6743fe24e731c2

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            fb278cc2851a917c889e94458999368d

                                                                                                            SHA1

                                                                                                            293cf290cf9cb8e110eefa3c836405dfa8822d4e

                                                                                                            SHA256

                                                                                                            29058b70fad785cd0c1e23c32e7b6c32211899e714719d530c43e4c4a2786125

                                                                                                            SHA512

                                                                                                            4e5027b0935fcfab798b8db616d7be4fdc2a283f660494867b1669606f45cec003986cdbe6740597849bd61b0e95106bfb6380af8f7798fceb6743fe24e731c2

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            0c84665a9cd33e3ec874ba38a5dcca73

                                                                                                            SHA1

                                                                                                            95dd373a851e3332df6b28cafdb0bb35c15d6ba4

                                                                                                            SHA256

                                                                                                            35bb46eb4300bfaa650011ea576653a8ca915905ff3b153a015931f38819e0e2

                                                                                                            SHA512

                                                                                                            326910a886177a9f02711770277584fdc0f8fab3f7828b9b9db54df7b160e25fbdb41c88cbe0a77fde6f017c9f536f7493b1d22b370c62fa91a44cdb23e7482d

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            0c84665a9cd33e3ec874ba38a5dcca73

                                                                                                            SHA1

                                                                                                            95dd373a851e3332df6b28cafdb0bb35c15d6ba4

                                                                                                            SHA256

                                                                                                            35bb46eb4300bfaa650011ea576653a8ca915905ff3b153a015931f38819e0e2

                                                                                                            SHA512

                                                                                                            326910a886177a9f02711770277584fdc0f8fab3f7828b9b9db54df7b160e25fbdb41c88cbe0a77fde6f017c9f536f7493b1d22b370c62fa91a44cdb23e7482d

                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            e9e0cbc34382320a4c1fab6e0f63da8b

                                                                                                            SHA1

                                                                                                            cb5f7c0b618600d79b5ee3fa19a2003bc6b7631d

                                                                                                            SHA256

                                                                                                            b007714e6cbf9bfeb9597f54edde84b2d86a9a7c26410cafb6d81562a733d294

                                                                                                            SHA512

                                                                                                            144551be64d625e1b8d03c0442845efbd5077a93ad9aa9b22215676966f33eae004c40fef43069ff774c52b8791b6dc0252e28be16392a0f2a3926010902c049

                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            e9e0cbc34382320a4c1fab6e0f63da8b

                                                                                                            SHA1

                                                                                                            cb5f7c0b618600d79b5ee3fa19a2003bc6b7631d

                                                                                                            SHA256

                                                                                                            b007714e6cbf9bfeb9597f54edde84b2d86a9a7c26410cafb6d81562a733d294

                                                                                                            SHA512

                                                                                                            144551be64d625e1b8d03c0442845efbd5077a93ad9aa9b22215676966f33eae004c40fef43069ff774c52b8791b6dc0252e28be16392a0f2a3926010902c049

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            7bc8f450e680bd301b30598cb0cf9464

                                                                                                            SHA1

                                                                                                            995fcde8a394904ecebc8391f41a2dcd8b5f6a3f

                                                                                                            SHA256

                                                                                                            0ee5fa1ecd47b1ea032ff5d1b187afdb2367f4547ebceeddd7554aae5b9adb3e

                                                                                                            SHA512

                                                                                                            722bfd8f45cb7a719e3edfbf61b05dc35eaf1f95aeb96b25564802a4a06463ec5167d8d42fd4eefbe2918323c0f14461dc784650d9635c58259fe624ad714c37

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            7bc8f450e680bd301b30598cb0cf9464

                                                                                                            SHA1

                                                                                                            995fcde8a394904ecebc8391f41a2dcd8b5f6a3f

                                                                                                            SHA256

                                                                                                            0ee5fa1ecd47b1ea032ff5d1b187afdb2367f4547ebceeddd7554aae5b9adb3e

                                                                                                            SHA512

                                                                                                            722bfd8f45cb7a719e3edfbf61b05dc35eaf1f95aeb96b25564802a4a06463ec5167d8d42fd4eefbe2918323c0f14461dc784650d9635c58259fe624ad714c37

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            04ec99ff906eea7bc3b903438e0e6954

                                                                                                            SHA1

                                                                                                            4cf08776a5cfd222da48b4eac3353f39b4374444

                                                                                                            SHA256

                                                                                                            e3779162cae1006bb814496f7bc27e5ab5628a98b5a859612bfc719f501f1989

                                                                                                            SHA512

                                                                                                            13fc3bf0b91d0e50e192a8648dfc6d353847e589999c9f9538a26cb311d5e126868a08effcf788b704dea80c68957d586fc57ecba8f026b20264ea1ec975ecfd

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            04ec99ff906eea7bc3b903438e0e6954

                                                                                                            SHA1

                                                                                                            4cf08776a5cfd222da48b4eac3353f39b4374444

                                                                                                            SHA256

                                                                                                            e3779162cae1006bb814496f7bc27e5ab5628a98b5a859612bfc719f501f1989

                                                                                                            SHA512

                                                                                                            13fc3bf0b91d0e50e192a8648dfc6d353847e589999c9f9538a26cb311d5e126868a08effcf788b704dea80c68957d586fc57ecba8f026b20264ea1ec975ecfd

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            83933c371e4f718d0bdba14597a55b6e

                                                                                                            SHA1

                                                                                                            de4a6f80530466c30f30a37898cf82ce3f308ab2

                                                                                                            SHA256

                                                                                                            0d3e05355d522e17ba7e1e94f6e652e720fde24383dcb2fe619f3b355bb79b6c

                                                                                                            SHA512

                                                                                                            dee4ea0bab064cf1b5abd1a947358e974a16d96444e25b8038a7b5548d5da15474feb1c21e46e08d0a79575772d08a2b2b1805b0eab9eaf0c56b1478d8936c13

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            83933c371e4f718d0bdba14597a55b6e

                                                                                                            SHA1

                                                                                                            de4a6f80530466c30f30a37898cf82ce3f308ab2

                                                                                                            SHA256

                                                                                                            0d3e05355d522e17ba7e1e94f6e652e720fde24383dcb2fe619f3b355bb79b6c

                                                                                                            SHA512

                                                                                                            dee4ea0bab064cf1b5abd1a947358e974a16d96444e25b8038a7b5548d5da15474feb1c21e46e08d0a79575772d08a2b2b1805b0eab9eaf0c56b1478d8936c13

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            42fe7c314cadae6fc94e9bcbb26e4923

                                                                                                            SHA1

                                                                                                            51336667762a3088e233760950d3f0d0f7a7a00a

                                                                                                            SHA256

                                                                                                            682b1010aae1e8581f6c51fbe90060a476ebbc344d38a45bb9392ab72fdad6ce

                                                                                                            SHA512

                                                                                                            7635cfa7c4a4bf79caaba4879b46c1e17c865ede3bad9302f5f156b92c354c76daf05b027ccb89687eabb7372aa7ab1bf321d1c2f279ef12e6b799001c112c28

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            42fe7c314cadae6fc94e9bcbb26e4923

                                                                                                            SHA1

                                                                                                            51336667762a3088e233760950d3f0d0f7a7a00a

                                                                                                            SHA256

                                                                                                            682b1010aae1e8581f6c51fbe90060a476ebbc344d38a45bb9392ab72fdad6ce

                                                                                                            SHA512

                                                                                                            7635cfa7c4a4bf79caaba4879b46c1e17c865ede3bad9302f5f156b92c354c76daf05b027ccb89687eabb7372aa7ab1bf321d1c2f279ef12e6b799001c112c28

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            468b1d21d09b97722e36ff086963672e

                                                                                                            SHA1

                                                                                                            2b2f5b3a5767509fc745a0e48bdc90646cf26a2f

                                                                                                            SHA256

                                                                                                            fa58dd08ae0747b023be789b5324f810b39838573849ff5cd39975dbe3ad20fe

                                                                                                            SHA512

                                                                                                            2568624fcc2073e432fc83d784d95fa37af33ebaaa9d645760585b8655ba50267fe1b8cb8f36d26f7e51a315cc7b16a9f3798b039941a471b80f10aa5fb04737

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            468b1d21d09b97722e36ff086963672e

                                                                                                            SHA1

                                                                                                            2b2f5b3a5767509fc745a0e48bdc90646cf26a2f

                                                                                                            SHA256

                                                                                                            fa58dd08ae0747b023be789b5324f810b39838573849ff5cd39975dbe3ad20fe

                                                                                                            SHA512

                                                                                                            2568624fcc2073e432fc83d784d95fa37af33ebaaa9d645760585b8655ba50267fe1b8cb8f36d26f7e51a315cc7b16a9f3798b039941a471b80f10aa5fb04737

                                                                                                          • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            24538253a23afaf7e58dfeb71a810081

                                                                                                            SHA1

                                                                                                            1ec9f929ffb32f9336085c68fb10b7e37ce651c0

                                                                                                            SHA256

                                                                                                            205e99bdb8f7550aaa6eac4730f442576a095a2cd4d1a8de475e6d5ce1e4dd99

                                                                                                            SHA512

                                                                                                            46440ae2612614508850b56d0722893bbef184f64d88b42f87457375fc33b55f323ba3f12a0de1a02d359cdcadfcaf6e79510e00f0af6e595bd78809f40dba22

                                                                                                          • C:\Program Files\Google\Chrome\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            569fa69bec9403ac7ee8e9cf86488933

                                                                                                            SHA1

                                                                                                            ce708ef8271cee9d8c75600563aa738d337decb1

                                                                                                            SHA256

                                                                                                            4bd9b044991d71a19b83dc9554a5a3d24db58b27c26dbd36d6689a7a5497c72a

                                                                                                            SHA512

                                                                                                            ed760e2cd6bbb4ebb376a2f54636e5997c089ec7dcd0836e80deac186b9d277185d0d9c083cab948c920a39bddc2a87634cfb0682326a4c01dcf797d32c9310c

                                                                                                          • C:\Program Files\Google\Chrome\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            569fa69bec9403ac7ee8e9cf86488933

                                                                                                            SHA1

                                                                                                            ce708ef8271cee9d8c75600563aa738d337decb1

                                                                                                            SHA256

                                                                                                            4bd9b044991d71a19b83dc9554a5a3d24db58b27c26dbd36d6689a7a5497c72a

                                                                                                            SHA512

                                                                                                            ed760e2cd6bbb4ebb376a2f54636e5997c089ec7dcd0836e80deac186b9d277185d0d9c083cab948c920a39bddc2a87634cfb0682326a4c01dcf797d32c9310c

                                                                                                          • C:\Program Files\Google\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            13753f387c3a0526386ff6e9b52b3ebd

                                                                                                            SHA1

                                                                                                            5879eea4967ab4ce6711280cee00954c5fb07af2

                                                                                                            SHA256

                                                                                                            c4c6be4e9b6e66f3c17f18c167d1706c85365f9c7b1178ff585f8aeac2d90d53

                                                                                                            SHA512

                                                                                                            8aedcb1b952a93c595179856a3cd9b26c64691b150c493274b59a365ded4f34e09142e0a28192ccace73f3392259e72412acf7be0426f1904be5acbcedc137e0

                                                                                                          • C:\Program Files\Google\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            13753f387c3a0526386ff6e9b52b3ebd

                                                                                                            SHA1

                                                                                                            5879eea4967ab4ce6711280cee00954c5fb07af2

                                                                                                            SHA256

                                                                                                            c4c6be4e9b6e66f3c17f18c167d1706c85365f9c7b1178ff585f8aeac2d90d53

                                                                                                            SHA512

                                                                                                            8aedcb1b952a93c595179856a3cd9b26c64691b150c493274b59a365ded4f34e09142e0a28192ccace73f3392259e72412acf7be0426f1904be5acbcedc137e0

                                                                                                          • C:\Program Files\update.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c117ebdc72681dc8a3b4266e65058302

                                                                                                            SHA1

                                                                                                            ce29218a5cfc6e85548306d88bd2f9c718801a5a

                                                                                                            SHA256

                                                                                                            0fd7bac59bef68896ffeb1ee4e135545e9a9df0824c58ac230e65efb0c7c8b9b

                                                                                                            SHA512

                                                                                                            c072dbef9508edff1dcdab9fe7ab22b8ab56372871ec5e201037dfd1359105741dec740ff1c57e752003820b1ffe55f216e0ffd49d5c75279149f1dc69d58617

                                                                                                          • C:\Program Files\update.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c117ebdc72681dc8a3b4266e65058302

                                                                                                            SHA1

                                                                                                            ce29218a5cfc6e85548306d88bd2f9c718801a5a

                                                                                                            SHA256

                                                                                                            0fd7bac59bef68896ffeb1ee4e135545e9a9df0824c58ac230e65efb0c7c8b9b

                                                                                                            SHA512

                                                                                                            c072dbef9508edff1dcdab9fe7ab22b8ab56372871ec5e201037dfd1359105741dec740ff1c57e752003820b1ffe55f216e0ffd49d5c75279149f1dc69d58617

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3075311536\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            43972fc68871eab7168e7627f7f461f6

                                                                                                            SHA1

                                                                                                            f7d57f45419395c219443c424bc7031e5096afbc

                                                                                                            SHA256

                                                                                                            61d3068f34d70b107175dfe6e90aa689dd39a893807cbf898b47f37a64320364

                                                                                                            SHA512

                                                                                                            aa06df0981a018201b3e1ed74aca91c840267bb44266c1af73e31e6d3bbd0467cd031be2235b259571e5ec1a59acc6c7c8fd229ab7228a85e44160f319f30ea9

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3075311536\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            43972fc68871eab7168e7627f7f461f6

                                                                                                            SHA1

                                                                                                            f7d57f45419395c219443c424bc7031e5096afbc

                                                                                                            SHA256

                                                                                                            61d3068f34d70b107175dfe6e90aa689dd39a893807cbf898b47f37a64320364

                                                                                                            SHA512

                                                                                                            aa06df0981a018201b3e1ed74aca91c840267bb44266c1af73e31e6d3bbd0467cd031be2235b259571e5ec1a59acc6c7c8fd229ab7228a85e44160f319f30ea9

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            f06d37f4e9869d8fb2c54dc31d6d49b7

                                                                                                            SHA1

                                                                                                            61529c6914876de90b48cecdd58939c36ec40ef5

                                                                                                            SHA256

                                                                                                            4c2c8803e7e7deda89f4d7030118d39d5684ddad1b5317eefaa24f8203a6111e

                                                                                                            SHA512

                                                                                                            4e6c1383723715cab5cbe7d4db47f42d3fa5c07e301ec22ec2b5983011f9426566ef2f182ab2a1855e645916e305b649a4bb4ed457f04510774ebd8bb48ce892

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            f06d37f4e9869d8fb2c54dc31d6d49b7

                                                                                                            SHA1

                                                                                                            61529c6914876de90b48cecdd58939c36ec40ef5

                                                                                                            SHA256

                                                                                                            4c2c8803e7e7deda89f4d7030118d39d5684ddad1b5317eefaa24f8203a6111e

                                                                                                            SHA512

                                                                                                            4e6c1383723715cab5cbe7d4db47f42d3fa5c07e301ec22ec2b5983011f9426566ef2f182ab2a1855e645916e305b649a4bb4ed457f04510774ebd8bb48ce892

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            f06d37f4e9869d8fb2c54dc31d6d49b7

                                                                                                            SHA1

                                                                                                            61529c6914876de90b48cecdd58939c36ec40ef5

                                                                                                            SHA256

                                                                                                            4c2c8803e7e7deda89f4d7030118d39d5684ddad1b5317eefaa24f8203a6111e

                                                                                                            SHA512

                                                                                                            4e6c1383723715cab5cbe7d4db47f42d3fa5c07e301ec22ec2b5983011f9426566ef2f182ab2a1855e645916e305b649a4bb4ed457f04510774ebd8bb48ce892

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            f06d37f4e9869d8fb2c54dc31d6d49b7

                                                                                                            SHA1

                                                                                                            61529c6914876de90b48cecdd58939c36ec40ef5

                                                                                                            SHA256

                                                                                                            4c2c8803e7e7deda89f4d7030118d39d5684ddad1b5317eefaa24f8203a6111e

                                                                                                            SHA512

                                                                                                            4e6c1383723715cab5cbe7d4db47f42d3fa5c07e301ec22ec2b5983011f9426566ef2f182ab2a1855e645916e305b649a4bb4ed457f04510774ebd8bb48ce892

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6267298853ee516dffa030c224b99bec

                                                                                                            SHA1

                                                                                                            5304ffcbb093bf26c47fb5f9f1891efd4f6720de

                                                                                                            SHA256

                                                                                                            3c4629ccf8db367ec5c386b8f1a8443b4df715388c4f4ae05047c8bf42d0c65a

                                                                                                            SHA512

                                                                                                            bdf01089c3e7b0acb39de8b153ca6efc9a624acd46955933e37240d40e3762b16154d0e8e677099274895d1efe989745d5bef5ec39eeff69d05b7884f667b427

                                                                                                          • C:\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            44e82a0054e627d0f6756a36d219bdb8

                                                                                                            SHA1

                                                                                                            0a70a150699427dedeceed3ed75351d5cae80b8f

                                                                                                            SHA256

                                                                                                            32e02659bb56b930473912cdda63155793c9ef910f262f86316777b3a074ee26

                                                                                                            SHA512

                                                                                                            a779f911fd92e94af260c810a61b0c281f5f548d673301fcd308d60de9516c4d8539729f7fa27fd0ab45faa37650682f1980e852604d1ae7af82c63b52b7f937

                                                                                                          • C:\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            44e82a0054e627d0f6756a36d219bdb8

                                                                                                            SHA1

                                                                                                            0a70a150699427dedeceed3ed75351d5cae80b8f

                                                                                                            SHA256

                                                                                                            32e02659bb56b930473912cdda63155793c9ef910f262f86316777b3a074ee26

                                                                                                            SHA512

                                                                                                            a779f911fd92e94af260c810a61b0c281f5f548d673301fcd308d60de9516c4d8539729f7fa27fd0ab45faa37650682f1980e852604d1ae7af82c63b52b7f937

                                                                                                          • C:\odt\System Restore.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a7c49f085bcd12529d21385de4910e57

                                                                                                            SHA1

                                                                                                            a1829b3549c13a3d48a5e4aaea6151498ba44f66

                                                                                                            SHA256

                                                                                                            9ac0a6818bc13f27069dbfdf77795f1d814df4f05d1af97f194a644de3d59f40

                                                                                                            SHA512

                                                                                                            5cf639309b74d16bcf28c093e74a2d8340bebad0d57ffe47b2ae878395e45e5bf617dc034366cd4c78f16cc1dc7f3d60114122d9336a453a4e0e11e24fea4ec6

                                                                                                          • C:\odt\System Restore.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a7c49f085bcd12529d21385de4910e57

                                                                                                            SHA1

                                                                                                            a1829b3549c13a3d48a5e4aaea6151498ba44f66

                                                                                                            SHA256

                                                                                                            9ac0a6818bc13f27069dbfdf77795f1d814df4f05d1af97f194a644de3d59f40

                                                                                                            SHA512

                                                                                                            5cf639309b74d16bcf28c093e74a2d8340bebad0d57ffe47b2ae878395e45e5bf617dc034366cd4c78f16cc1dc7f3d60114122d9336a453a4e0e11e24fea4ec6