Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    226s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/11/2022, 14:10

General

  • Target

    65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe

  • Size

    72KB

  • MD5

    0a1fa8f639125448774cb1ba2cfdf870

  • SHA1

    921f41a6155c36564b581e640d8aac8dcbd6e8ba

  • SHA256

    65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8

  • SHA512

    0baec6df52c5498b6f4645e9f837c4a9460425594ae0a8a5e79bb45a188f4225056d8d4795aeb7aecd4c781988f9a662a7eac84dc0f90f283454e98f9e432f5d

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2v:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrj

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 13 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe
    "C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\1420136871\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1420136871\backup.exe C:\Users\Admin\AppData\Local\Temp\1420136871\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:4000
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3568
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1668
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2332
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4712
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2708
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3312
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3140
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2384
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:2296
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4092
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1560
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:592
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2464
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3116
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3672
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3324
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1240
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3144
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3684
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2256
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:5020
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4356
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • System policy modification
                  PID:400
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:3208
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                    PID:1332
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                    8⤵
                    • Drops file in Program Files directory
                    PID:2252
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                      9⤵
                        PID:4420
                        • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                          "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                          10⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:4320
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                        9⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:3964
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                        9⤵
                          PID:3180
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                          9⤵
                          • Disables RegEdit via registry modification
                          PID:4740
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                          9⤵
                            PID:4524
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                            9⤵
                              PID:1696
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                              9⤵
                                PID:3468
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                                9⤵
                                • Disables RegEdit via registry modification
                                PID:5020
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                                9⤵
                                  PID:2264
                                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                                  9⤵
                                    PID:2960
                                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                                  8⤵
                                    PID:4428
                                  • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                                    8⤵
                                    • System policy modification
                                    PID:5012
                                  • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:828
                                  • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                                    8⤵
                                      PID:1128
                                    • C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\it-IT\data.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                                      8⤵
                                        PID:3500
                                      • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                                        8⤵
                                          PID:4456
                                        • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:5096
                                        • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                          8⤵
                                            PID:1124
                                          • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                            8⤵
                                              PID:4192
                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3788
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:2432
                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                              8⤵
                                                PID:1460
                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe
                                                "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:2636
                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:3360
                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                PID:3260
                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                8⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:4472
                                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                              7⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:2680
                                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe
                                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                8⤵
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:3376
                                            • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1668
                                            • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:3620
                                            • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                              7⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4552
                                            • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                              7⤵
                                              • System policy modification
                                              PID:3064
                                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:4456
                                            • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                              7⤵
                                                PID:3436
                                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                                  8⤵
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:2580
                                              • C:\Program Files\Common Files\microsoft shared\VC\data.exe
                                                "C:\Program Files\Common Files\microsoft shared\VC\data.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                                7⤵
                                                  PID:3464
                                                • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                                  7⤵
                                                    PID:1212
                                                  • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                                    7⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Drops file in Program Files directory
                                                    PID:3776
                                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                                      8⤵
                                                        PID:1624
                                                        • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\data.exe
                                                          "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                                          9⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:1288
                                                  • C:\Program Files\Common Files\Services\backup.exe
                                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1212
                                                  • C:\Program Files\Common Files\System\backup.exe
                                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:476
                                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                      7⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:456
                                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • Executes dropped EXE
                                                        PID:3048
                                                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                        8⤵
                                                        • System policy modification
                                                        PID:4940
                                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                        8⤵
                                                        • System policy modification
                                                        PID:3828
                                                      • C:\Program Files\Common Files\System\ado\it-IT\data.exe
                                                        "C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                        8⤵
                                                          PID:3744
                                                        • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          PID:1636
                                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                        7⤵
                                                          PID:3324
                                                        • C:\Program Files\Common Files\System\en-US\backup.exe
                                                          "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                          7⤵
                                                            PID:4540
                                                          • C:\Program Files\Common Files\System\es-ES\System Restore.exe
                                                            "C:\Program Files\Common Files\System\es-ES\System Restore.exe" C:\Program Files\Common Files\System\es-ES\
                                                            7⤵
                                                            • System policy modification
                                                            PID:1544
                                                          • C:\Program Files\Common Files\System\msadc\backup.exe
                                                            "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:3172
                                                            • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                              "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                              8⤵
                                                                PID:3236
                                                              • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                8⤵
                                                                • System policy modification
                                                                PID:3368
                                                              • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:3064
                                                              • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                                "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                8⤵
                                                                  PID:4252
                                                                • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                  8⤵
                                                                    PID:4640
                                                                • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                  7⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:1648
                                                                • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                  7⤵
                                                                    PID:1592
                                                                  • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                    7⤵
                                                                    • System policy modification
                                                                    PID:3368
                                                                  • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                    "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                    7⤵
                                                                      PID:2068
                                                                • C:\Program Files\Google\backup.exe
                                                                  "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1056
                                                                  • C:\Program Files\Google\Chrome\backup.exe
                                                                    "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                    6⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:1364
                                                                    • C:\Program Files\Google\Chrome\Application\update.exe
                                                                      "C:\Program Files\Google\Chrome\Application\update.exe" C:\Program Files\Google\Chrome\Application\
                                                                      7⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:3108
                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                        8⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:924
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                          9⤵
                                                                            PID:3696
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:2528
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:4924
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:3052
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                            9⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:3400
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                            9⤵
                                                                              PID:3704
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                              9⤵
                                                                              • Disables RegEdit via registry modification
                                                                              PID:4208
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:4276
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                10⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Drops file in Program Files directory
                                                                                PID:2332
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                  11⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:3324
                                                                          • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:320
                                                                    • C:\Program Files\Internet Explorer\backup.exe
                                                                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                      5⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4580
                                                                      • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1844
                                                                      • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                        "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                        6⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:2600
                                                                      • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1768
                                                                      • C:\Program Files\Internet Explorer\images\backup.exe
                                                                        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                        6⤵
                                                                          PID:3136
                                                                        • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                          "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3912
                                                                        • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                          "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                          6⤵
                                                                            PID:2128
                                                                          • C:\Program Files\Internet Explorer\ja-JP\update.exe
                                                                            "C:\Program Files\Internet Explorer\ja-JP\update.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                            6⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1460
                                                                          • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                            "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                            6⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:3296
                                                                        • C:\Program Files\Java\backup.exe
                                                                          "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                          5⤵
                                                                          • Drops file in Program Files directory
                                                                          • System policy modification
                                                                          PID:4520
                                                                          • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                            "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                            6⤵
                                                                            • Drops file in Program Files directory
                                                                            • System policy modification
                                                                            PID:2804
                                                                            • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                              "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                              7⤵
                                                                              • System policy modification
                                                                              PID:808
                                                                            • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                              "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                              7⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Drops file in Program Files directory
                                                                              PID:4420
                                                                              • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                8⤵
                                                                                  PID:3208
                                                                              • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                7⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Drops file in Program Files directory
                                                                                PID:1128
                                                                                • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                  8⤵
                                                                                    PID:592
                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                      9⤵
                                                                                        PID:1240
                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                    7⤵
                                                                                      PID:3124
                                                                                  • C:\Program Files\Java\jre1.8.0_66\update.exe
                                                                                    "C:\Program Files\Java\jre1.8.0_66\update.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                    6⤵
                                                                                      PID:4080
                                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                    5⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:4928
                                                                                    • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                      "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                      6⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:2464
                                                                                    • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                                                      "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                      6⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:2572
                                                                                    • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                      "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                      6⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Drops file in Program Files directory
                                                                                      PID:1056
                                                                                      • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                        "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                        7⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        PID:424
                                                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                        7⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        PID:2160
                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                          8⤵
                                                                                            PID:4016
                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • System policy modification
                                                                                            PID:4276
                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe
                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                            8⤵
                                                                                              PID:932
                                                                                          • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                            "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                            7⤵
                                                                                              PID:4700
                                                                                          • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                            "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                            6⤵
                                                                                              PID:2376
                                                                                          • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                            "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                            5⤵
                                                                                              PID:424
                                                                                          • C:\Program Files (x86)\backup.exe
                                                                                            "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                            4⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:1912
                                                                                            • C:\Program Files (x86)\Adobe\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                              5⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:448
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                6⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3160
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                  7⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4092
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                  7⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4328
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                    8⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:3144
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                      9⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:2576
                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                    8⤵
                                                                                                      PID:3184
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                      8⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:2104
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                      8⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:3676
                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                        9⤵
                                                                                                        • System policy modification
                                                                                                        PID:1772
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                      8⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:1808
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                      8⤵
                                                                                                      • System policy modification
                                                                                                      PID:4372
                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                      8⤵
                                                                                                        PID:2228
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                          9⤵
                                                                                                            PID:1948
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                          8⤵
                                                                                                            PID:2436
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                            8⤵
                                                                                                              PID:692
                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                            7⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System policy modification
                                                                                                            PID:3976
                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                              8⤵
                                                                                                                PID:2128
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                  9⤵
                                                                                                                    PID:5044
                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                  8⤵
                                                                                                                    PID:1640
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                    8⤵
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:8
                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                      9⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:4284
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                        10⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:4164
                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                        10⤵
                                                                                                                          PID:4764
                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                    7⤵
                                                                                                                      PID:3632
                                                                                                                • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                  5⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:4268
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                    6⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:3828
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                      7⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:2256
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                        8⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:4796
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                      7⤵
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:2680
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                      7⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • System policy modification
                                                                                                                      PID:4820
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                        8⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:2100
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                      7⤵
                                                                                                                      • System policy modification
                                                                                                                      PID:1592
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                        8⤵
                                                                                                                          PID:3656
                                                                                                                    • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                      6⤵
                                                                                                                        PID:3860
                                                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                      5⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      PID:2176
                                                                                                                      • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                        6⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:4456
                                                                                                                      • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                        6⤵
                                                                                                                          PID:4224
                                                                                                                        • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                          "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                          6⤵
                                                                                                                            PID:404
                                                                                                                          • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                            "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                            6⤵
                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            • System policy modification
                                                                                                                            PID:2792
                                                                                                                            • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                              "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                              7⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • System policy modification
                                                                                                                              PID:2680
                                                                                                                            • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                              "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                              7⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:4856
                                                                                                                              • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                                                "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                                                8⤵
                                                                                                                                  PID:1960
                                                                                                                              • C:\Program Files (x86)\Google\Update\Install\backup.exe
                                                                                                                                "C:\Program Files (x86)\Google\Update\Install\backup.exe" C:\Program Files (x86)\Google\Update\Install\
                                                                                                                                7⤵
                                                                                                                                  PID:4784
                                                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                              5⤵
                                                                                                                                PID:4504
                                                                                                                            • C:\Users\backup.exe
                                                                                                                              C:\Users\backup.exe C:\Users\
                                                                                                                              4⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              • System policy modification
                                                                                                                              PID:4464
                                                                                                                              • C:\Users\Admin\backup.exe
                                                                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                5⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                • System policy modification
                                                                                                                                PID:116
                                                                                                                                • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                                  "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                                  6⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  • System policy modification
                                                                                                                                  PID:2228
                                                                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                  6⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:1012
                                                                                                                                • C:\Users\Admin\Downloads\data.exe
                                                                                                                                  C:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\
                                                                                                                                  6⤵
                                                                                                                                    PID:2068
                                                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                    6⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:224
                                                                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                    6⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:4408
                                                                                                                                  • C:\Users\Admin\Links\backup.exe
                                                                                                                                    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                    6⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • System policy modification
                                                                                                                                    PID:2708
                                                                                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                    6⤵
                                                                                                                                      PID:808
                                                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                      6⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:1392
                                                                                                                                    • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                      C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                      6⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:2648
                                                                                                                                    • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                      C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                      6⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:992
                                                                                                                                      • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                                        7⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System policy modification
                                                                                                                                        PID:1480
                                                                                                                                      • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                                        "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                                        7⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:1840
                                                                                                                                    • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                      "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                      6⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • System policy modification
                                                                                                                                      PID:4316
                                                                                                                                    • C:\Users\Admin\Searches\backup.exe
                                                                                                                                      C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                                      6⤵
                                                                                                                                        PID:3012
                                                                                                                                      • C:\Users\Admin\Videos\backup.exe
                                                                                                                                        C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                                        6⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        • System policy modification
                                                                                                                                        PID:3040
                                                                                                                                    • C:\Users\Public\backup.exe
                                                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                      5⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:3696
                                                                                                                                      • C:\Users\Public\Documents\backup.exe
                                                                                                                                        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                        6⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        PID:3632
                                                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                        6⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:1896
                                                                                                                                      • C:\Users\Public\Music\backup.exe
                                                                                                                                        C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                        6⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System policy modification
                                                                                                                                        PID:1976
                                                                                                                                      • C:\Users\Public\Pictures\backup.exe
                                                                                                                                        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                        6⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:2192
                                                                                                                                      • C:\Users\Public\Videos\backup.exe
                                                                                                                                        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                        6⤵
                                                                                                                                        • System policy modification
                                                                                                                                        PID:3792
                                                                                                                                  • C:\Windows\backup.exe
                                                                                                                                    C:\Windows\backup.exe C:\Windows\
                                                                                                                                    4⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:1964
                                                                                                                                    • C:\Windows\addins\backup.exe
                                                                                                                                      C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                      5⤵
                                                                                                                                        PID:1756
                                                                                                                                      • C:\Windows\appcompat\backup.exe
                                                                                                                                        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                        5⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:3744
                                                                                                                                        • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                          C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                          6⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:1960
                                                                                                                                          • C:\Windows\appcompat\appraiser\Telemetry\data.exe
                                                                                                                                            C:\Windows\appcompat\appraiser\Telemetry\data.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                            7⤵
                                                                                                                                              PID:1568
                                                                                                                                          • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                            C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                            6⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • System policy modification
                                                                                                                                            PID:3568
                                                                                                                                          • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                            C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                            6⤵
                                                                                                                                              PID:2544
                                                                                                                                          • C:\Windows\apppatch\backup.exe
                                                                                                                                            C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                            5⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            PID:740
                                                                                                                                            • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                              C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                              6⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • System policy modification
                                                                                                                                              PID:4092
                                                                                                                                            • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                              C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                              6⤵
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System policy modification
                                                                                                                                              PID:2656
                                                                                                                                            • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                                              C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                                              6⤵
                                                                                                                                                PID:320
                                                                                                                                            • C:\Windows\AppReadiness\backup.exe
                                                                                                                                              C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                                              5⤵
                                                                                                                                                PID:2428
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:4936
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:116
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:2832
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                          2⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:3484
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                          2⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:3476
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                          2⤵
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                          PID:5116
                                                                                                                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                                                                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                                                                                        1⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        PID:2976
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                        1⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System policy modification
                                                                                                                                        PID:3508
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                        1⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        PID:3996
                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                        1⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • System policy modification
                                                                                                                                        PID:2208

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v6

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\PerfLogs\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        f8cf8e1433e035c2277b8989ab42e70d

                                                                                                                                        SHA1

                                                                                                                                        f2e1a989c5a4f0277e50036791df82a83ba5e2fd

                                                                                                                                        SHA256

                                                                                                                                        4c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500

                                                                                                                                        SHA512

                                                                                                                                        cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6

                                                                                                                                      • C:\PerfLogs\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        f8cf8e1433e035c2277b8989ab42e70d

                                                                                                                                        SHA1

                                                                                                                                        f2e1a989c5a4f0277e50036791df82a83ba5e2fd

                                                                                                                                        SHA256

                                                                                                                                        4c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500

                                                                                                                                        SHA512

                                                                                                                                        cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6

                                                                                                                                      • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5cfd1a12a70648208fda400fad9160d8

                                                                                                                                        SHA1

                                                                                                                                        3b29a55bfdc8c235954e8f51a23a7e6f9bf3a4ed

                                                                                                                                        SHA256

                                                                                                                                        7ca95fb165cf0a16b1a734f212c5bfb995b748fd19da5ba0e6ae0002ba35f6a3

                                                                                                                                        SHA512

                                                                                                                                        c0e736ff84e48284c68a5a3e4448cbcbcbf625aac5a64bee5535eca0938757ad1a5586f9eb66adc9fd9b1c9324ee2c118bbfbffe4dae94179401e50c160f4f16

                                                                                                                                      • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5cfd1a12a70648208fda400fad9160d8

                                                                                                                                        SHA1

                                                                                                                                        3b29a55bfdc8c235954e8f51a23a7e6f9bf3a4ed

                                                                                                                                        SHA256

                                                                                                                                        7ca95fb165cf0a16b1a734f212c5bfb995b748fd19da5ba0e6ae0002ba35f6a3

                                                                                                                                        SHA512

                                                                                                                                        c0e736ff84e48284c68a5a3e4448cbcbcbf625aac5a64bee5535eca0938757ad1a5586f9eb66adc9fd9b1c9324ee2c118bbfbffe4dae94179401e50c160f4f16

                                                                                                                                      • C:\Program Files (x86)\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        978bdac788ef8905bb544a1bd2cbf802

                                                                                                                                        SHA1

                                                                                                                                        27c9be7aa8c754d80fd3153a1cb4f0289c815144

                                                                                                                                        SHA256

                                                                                                                                        fe5ef0ab4f864ac4dbd6560e96bb7f4a00cf34942a875e113277f8fdc9c37d13

                                                                                                                                        SHA512

                                                                                                                                        8bd3d59c1f0e52ebcc60e49d51997f7b2b00ea41e6b244ab8dafaa0d97cabea878c574687479f282d6f6918752fd17c67715ec3b34a6b27159e83a4e893a5d59

                                                                                                                                      • C:\Program Files (x86)\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        978bdac788ef8905bb544a1bd2cbf802

                                                                                                                                        SHA1

                                                                                                                                        27c9be7aa8c754d80fd3153a1cb4f0289c815144

                                                                                                                                        SHA256

                                                                                                                                        fe5ef0ab4f864ac4dbd6560e96bb7f4a00cf34942a875e113277f8fdc9c37d13

                                                                                                                                        SHA512

                                                                                                                                        8bd3d59c1f0e52ebcc60e49d51997f7b2b00ea41e6b244ab8dafaa0d97cabea878c574687479f282d6f6918752fd17c67715ec3b34a6b27159e83a4e893a5d59

                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        8fbb71dc7039a3a8a8e8c288ec48db63

                                                                                                                                        SHA1

                                                                                                                                        e811022408805a82e6a43310fe82039683f7c51c

                                                                                                                                        SHA256

                                                                                                                                        5b569c20cc0aac3dab0b10cb3926c0c5d4fdb9e0a7649aa87fff6e41ab08787b

                                                                                                                                        SHA512

                                                                                                                                        d09431c7becd367d0bfc64827c027ea55f7e832b50a6feae7f098dc0bd71c5c889f58420e8dfe4eb07cda6b565f1f66783bb5fa33b97600abacf09fdb92c575e

                                                                                                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        8fbb71dc7039a3a8a8e8c288ec48db63

                                                                                                                                        SHA1

                                                                                                                                        e811022408805a82e6a43310fe82039683f7c51c

                                                                                                                                        SHA256

                                                                                                                                        5b569c20cc0aac3dab0b10cb3926c0c5d4fdb9e0a7649aa87fff6e41ab08787b

                                                                                                                                        SHA512

                                                                                                                                        d09431c7becd367d0bfc64827c027ea55f7e832b50a6feae7f098dc0bd71c5c889f58420e8dfe4eb07cda6b565f1f66783bb5fa33b97600abacf09fdb92c575e

                                                                                                                                      • C:\Program Files\7-Zip\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5e0d47d232280bb51f6bc2668e8d1836

                                                                                                                                        SHA1

                                                                                                                                        1e394848fa08fcc4c0bab8cd1e57608eea0d77cb

                                                                                                                                        SHA256

                                                                                                                                        96f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d

                                                                                                                                        SHA512

                                                                                                                                        0e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478

                                                                                                                                      • C:\Program Files\7-Zip\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5e0d47d232280bb51f6bc2668e8d1836

                                                                                                                                        SHA1

                                                                                                                                        1e394848fa08fcc4c0bab8cd1e57608eea0d77cb

                                                                                                                                        SHA256

                                                                                                                                        96f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d

                                                                                                                                        SHA512

                                                                                                                                        0e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478

                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        753c57c71f0e161df707de77fa660571

                                                                                                                                        SHA1

                                                                                                                                        267df3f31a061e14807f33cb627d2f5b34716b79

                                                                                                                                        SHA256

                                                                                                                                        4b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130

                                                                                                                                        SHA512

                                                                                                                                        e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647

                                                                                                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        753c57c71f0e161df707de77fa660571

                                                                                                                                        SHA1

                                                                                                                                        267df3f31a061e14807f33cb627d2f5b34716b79

                                                                                                                                        SHA256

                                                                                                                                        4b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130

                                                                                                                                        SHA512

                                                                                                                                        e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647

                                                                                                                                      • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        6273261120069d812e669aabe091b64f

                                                                                                                                        SHA1

                                                                                                                                        2b7e93dd950bdb951197dee7d631db7ccb0b5b76

                                                                                                                                        SHA256

                                                                                                                                        dcc07a441b45b131ae545f31512327e8f0e79957eeaa2807beb6f6299fc0af39

                                                                                                                                        SHA512

                                                                                                                                        fdf0f70cd3a379b175c3afba171555c237691c90daa58d63fc6b97fcfdd4e9cd49edf5e1161954cb8cd89b12908dd6c57f7f24cf5efcfc2caf05cd2126341ad1

                                                                                                                                      • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        6273261120069d812e669aabe091b64f

                                                                                                                                        SHA1

                                                                                                                                        2b7e93dd950bdb951197dee7d631db7ccb0b5b76

                                                                                                                                        SHA256

                                                                                                                                        dcc07a441b45b131ae545f31512327e8f0e79957eeaa2807beb6f6299fc0af39

                                                                                                                                        SHA512

                                                                                                                                        fdf0f70cd3a379b175c3afba171555c237691c90daa58d63fc6b97fcfdd4e9cd49edf5e1161954cb8cd89b12908dd6c57f7f24cf5efcfc2caf05cd2126341ad1

                                                                                                                                      • C:\Program Files\Common Files\System\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        d14daca447cdb85cc4fb5b5bc2e2045b

                                                                                                                                        SHA1

                                                                                                                                        8b4f94e22597b6f4c8f7c9aff4c61e1a5763e170

                                                                                                                                        SHA256

                                                                                                                                        98fd822bd04e6e4f9aba84dbfbbd81a155da2775779ffc71594849ec18d860f7

                                                                                                                                        SHA512

                                                                                                                                        422fd29fa23ab4d0b850526bf92351a612618c7d92d8d05540b7d29f11f096784448e91fdde8a8d779394a4bdff20f3a56b8cf91febfdcd2578d58dbf62e3dcf

                                                                                                                                      • C:\Program Files\Common Files\System\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        d14daca447cdb85cc4fb5b5bc2e2045b

                                                                                                                                        SHA1

                                                                                                                                        8b4f94e22597b6f4c8f7c9aff4c61e1a5763e170

                                                                                                                                        SHA256

                                                                                                                                        98fd822bd04e6e4f9aba84dbfbbd81a155da2775779ffc71594849ec18d860f7

                                                                                                                                        SHA512

                                                                                                                                        422fd29fa23ab4d0b850526bf92351a612618c7d92d8d05540b7d29f11f096784448e91fdde8a8d779394a4bdff20f3a56b8cf91febfdcd2578d58dbf62e3dcf

                                                                                                                                      • C:\Program Files\Common Files\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5e0d47d232280bb51f6bc2668e8d1836

                                                                                                                                        SHA1

                                                                                                                                        1e394848fa08fcc4c0bab8cd1e57608eea0d77cb

                                                                                                                                        SHA256

                                                                                                                                        96f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d

                                                                                                                                        SHA512

                                                                                                                                        0e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478

                                                                                                                                      • C:\Program Files\Common Files\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5e0d47d232280bb51f6bc2668e8d1836

                                                                                                                                        SHA1

                                                                                                                                        1e394848fa08fcc4c0bab8cd1e57608eea0d77cb

                                                                                                                                        SHA256

                                                                                                                                        96f48dffcda54729f69411ccc73b4b544092aa22bc35f11421e57b91a65b904d

                                                                                                                                        SHA512

                                                                                                                                        0e3c6eff14398d053fd37b8d944eb9bb709b69ef81b9f937493777d0f407dc3367faf1446dd19d76bdb2ab785fd2d27852bdeba450f1b611d264407fb90e4478

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        8be7835c59bfb327100f0c4baefa5100

                                                                                                                                        SHA1

                                                                                                                                        8cd6540a35ef853e66db27205fab2bac3d8d69f1

                                                                                                                                        SHA256

                                                                                                                                        ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b

                                                                                                                                        SHA512

                                                                                                                                        6ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        8be7835c59bfb327100f0c4baefa5100

                                                                                                                                        SHA1

                                                                                                                                        8cd6540a35ef853e66db27205fab2bac3d8d69f1

                                                                                                                                        SHA256

                                                                                                                                        ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b

                                                                                                                                        SHA512

                                                                                                                                        6ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        0237f639256247217c6bfdac70841768

                                                                                                                                        SHA1

                                                                                                                                        7d0e8ffd67c6dcdc5e32c5ff27534c4a423d4de2

                                                                                                                                        SHA256

                                                                                                                                        ad88df92015f48e6474c0c5b2f6d89c7cc7a49a9b0b4d41bda2453986315fea2

                                                                                                                                        SHA512

                                                                                                                                        cce8612ada08b10d8f30e5ed9f7287fcff818bcf7dc5a5ec1e2c62a20ab790b6a630eebec39c18051bfabd61e7e93dbf5217779f8d10315cc26aef3a05c730a4

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        0237f639256247217c6bfdac70841768

                                                                                                                                        SHA1

                                                                                                                                        7d0e8ffd67c6dcdc5e32c5ff27534c4a423d4de2

                                                                                                                                        SHA256

                                                                                                                                        ad88df92015f48e6474c0c5b2f6d89c7cc7a49a9b0b4d41bda2453986315fea2

                                                                                                                                        SHA512

                                                                                                                                        cce8612ada08b10d8f30e5ed9f7287fcff818bcf7dc5a5ec1e2c62a20ab790b6a630eebec39c18051bfabd61e7e93dbf5217779f8d10315cc26aef3a05c730a4

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        ca091200e66ed448c9b09e165cb1f758

                                                                                                                                        SHA1

                                                                                                                                        43c03277524acc16d3cef60534a11bd4937fa932

                                                                                                                                        SHA256

                                                                                                                                        5da6713e0630b936fb521f191a8b400dea872aa80bf93db41a04afd6a2f37131

                                                                                                                                        SHA512

                                                                                                                                        58010b3c40c9470579cdc63aee869d74a629aaf16cdeaef31f40814940d9d0adc6f041fbe2c8fe6445edc93df5ef10beec3ae03f5363a9394c46e95d4e168339

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        ca091200e66ed448c9b09e165cb1f758

                                                                                                                                        SHA1

                                                                                                                                        43c03277524acc16d3cef60534a11bd4937fa932

                                                                                                                                        SHA256

                                                                                                                                        5da6713e0630b936fb521f191a8b400dea872aa80bf93db41a04afd6a2f37131

                                                                                                                                        SHA512

                                                                                                                                        58010b3c40c9470579cdc63aee869d74a629aaf16cdeaef31f40814940d9d0adc6f041fbe2c8fe6445edc93df5ef10beec3ae03f5363a9394c46e95d4e168339

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        753c57c71f0e161df707de77fa660571

                                                                                                                                        SHA1

                                                                                                                                        267df3f31a061e14807f33cb627d2f5b34716b79

                                                                                                                                        SHA256

                                                                                                                                        4b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130

                                                                                                                                        SHA512

                                                                                                                                        e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        753c57c71f0e161df707de77fa660571

                                                                                                                                        SHA1

                                                                                                                                        267df3f31a061e14807f33cb627d2f5b34716b79

                                                                                                                                        SHA256

                                                                                                                                        4b57593b9d49b9565c5dd99e436b016d3d2b38d28b186d5a20db31e4ea8dc130

                                                                                                                                        SHA512

                                                                                                                                        e65fab6b8a113cca4ace4b2294d387cbe9d35bc4bb8d09b92a2f1ed7c4fb357ff5473f9a63cc449acf4d217d2936c67a3e3024688662dd6621b65f110b2ef647

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4f13e146d19d30133477d7077652a591

                                                                                                                                        SHA1

                                                                                                                                        6d1efcf838c894f067e3f5c26202762957bd458b

                                                                                                                                        SHA256

                                                                                                                                        392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd

                                                                                                                                        SHA512

                                                                                                                                        277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4f13e146d19d30133477d7077652a591

                                                                                                                                        SHA1

                                                                                                                                        6d1efcf838c894f067e3f5c26202762957bd458b

                                                                                                                                        SHA256

                                                                                                                                        392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd

                                                                                                                                        SHA512

                                                                                                                                        277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        8be7835c59bfb327100f0c4baefa5100

                                                                                                                                        SHA1

                                                                                                                                        8cd6540a35ef853e66db27205fab2bac3d8d69f1

                                                                                                                                        SHA256

                                                                                                                                        ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b

                                                                                                                                        SHA512

                                                                                                                                        6ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        8be7835c59bfb327100f0c4baefa5100

                                                                                                                                        SHA1

                                                                                                                                        8cd6540a35ef853e66db27205fab2bac3d8d69f1

                                                                                                                                        SHA256

                                                                                                                                        ed16be34773cebe316c9e6ea0110e5cb49c281c94523ddf8b70e992160cec60b

                                                                                                                                        SHA512

                                                                                                                                        6ec0f09914428d86b487424a689489d1959efcc9551155ed5bd872a6cb829bb9cf11a30cb068779851f9e5d824e4690992b5fdcf2d085ef79e3953b057d2c60f

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4f13e146d19d30133477d7077652a591

                                                                                                                                        SHA1

                                                                                                                                        6d1efcf838c894f067e3f5c26202762957bd458b

                                                                                                                                        SHA256

                                                                                                                                        392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd

                                                                                                                                        SHA512

                                                                                                                                        277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4f13e146d19d30133477d7077652a591

                                                                                                                                        SHA1

                                                                                                                                        6d1efcf838c894f067e3f5c26202762957bd458b

                                                                                                                                        SHA256

                                                                                                                                        392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd

                                                                                                                                        SHA512

                                                                                                                                        277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4f13e146d19d30133477d7077652a591

                                                                                                                                        SHA1

                                                                                                                                        6d1efcf838c894f067e3f5c26202762957bd458b

                                                                                                                                        SHA256

                                                                                                                                        392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd

                                                                                                                                        SHA512

                                                                                                                                        277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4f13e146d19d30133477d7077652a591

                                                                                                                                        SHA1

                                                                                                                                        6d1efcf838c894f067e3f5c26202762957bd458b

                                                                                                                                        SHA256

                                                                                                                                        392237da20ea4ec12d6cd783f0f7a83614cc9b1f24054ec4f1ca2e77f70432bd

                                                                                                                                        SHA512

                                                                                                                                        277d7edd56d7fb066a00954b5d8bf0fb59df536be3e7d28ab3e3392c4b7a847ce73a6a451ec25115396e4fb81e1f85f8f40cc97f8239301869f9f6e3127889c2

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        30c87f3e353c338cd8d7d7004d89a75e

                                                                                                                                        SHA1

                                                                                                                                        caa1661a7e244549ace0697cb1594c4abc974db9

                                                                                                                                        SHA256

                                                                                                                                        5adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5

                                                                                                                                        SHA512

                                                                                                                                        afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        30c87f3e353c338cd8d7d7004d89a75e

                                                                                                                                        SHA1

                                                                                                                                        caa1661a7e244549ace0697cb1594c4abc974db9

                                                                                                                                        SHA256

                                                                                                                                        5adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5

                                                                                                                                        SHA512

                                                                                                                                        afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        30c87f3e353c338cd8d7d7004d89a75e

                                                                                                                                        SHA1

                                                                                                                                        caa1661a7e244549ace0697cb1594c4abc974db9

                                                                                                                                        SHA256

                                                                                                                                        5adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5

                                                                                                                                        SHA512

                                                                                                                                        afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        30c87f3e353c338cd8d7d7004d89a75e

                                                                                                                                        SHA1

                                                                                                                                        caa1661a7e244549ace0697cb1594c4abc974db9

                                                                                                                                        SHA256

                                                                                                                                        5adcdfd58983bdbf660d4a13b865aab158431c0f1d0961cc15fd2419f4477fe5

                                                                                                                                        SHA512

                                                                                                                                        afbf73ddf7c8d1a1c973680f0af9984e8deb9b7ab8f2193ecfe189706b9e838391abc3ff8984ca25777787f31f90fcea4730c252128c7e08b0ecf799d3cdba1d

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        a95db4d2b940df2a9035b52ed2b9c286

                                                                                                                                        SHA1

                                                                                                                                        09c1728911614d511f4e175d8c4e6ace922c3456

                                                                                                                                        SHA256

                                                                                                                                        4ac95bb08e46c8a2500e283396b6ae05f545224a3e024f4440b859eade4f9193

                                                                                                                                        SHA512

                                                                                                                                        8b2919aef9b52aeb859c8fa90b764e54f6581148ee4a7e31ac71b271a88f1d63f41e04941251300548647c5cbac1e640da7e49e13fd46a79034d21c7fac1d1ed

                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        a95db4d2b940df2a9035b52ed2b9c286

                                                                                                                                        SHA1

                                                                                                                                        09c1728911614d511f4e175d8c4e6ace922c3456

                                                                                                                                        SHA256

                                                                                                                                        4ac95bb08e46c8a2500e283396b6ae05f545224a3e024f4440b859eade4f9193

                                                                                                                                        SHA512

                                                                                                                                        8b2919aef9b52aeb859c8fa90b764e54f6581148ee4a7e31ac71b271a88f1d63f41e04941251300548647c5cbac1e640da7e49e13fd46a79034d21c7fac1d1ed

                                                                                                                                      • C:\Program Files\Google\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4aefdcfe21bb4fee2a98e3e9f18fe967

                                                                                                                                        SHA1

                                                                                                                                        3d4cb0646f6901d80564b3f6784cf5b6b8fc0a7f

                                                                                                                                        SHA256

                                                                                                                                        50d19bb7f01b6c4465d3b6836afde146191745ed4c113eb1ce914e9522d005b5

                                                                                                                                        SHA512

                                                                                                                                        52821970450912e88ef2f0da8e6db1573a419bac0843d90403b4af747cded6307831d0f59bf09f77da69c62337a18e87a57b6a28130e92ccb0eba45b0064b834

                                                                                                                                      • C:\Program Files\Google\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        4aefdcfe21bb4fee2a98e3e9f18fe967

                                                                                                                                        SHA1

                                                                                                                                        3d4cb0646f6901d80564b3f6784cf5b6b8fc0a7f

                                                                                                                                        SHA256

                                                                                                                                        50d19bb7f01b6c4465d3b6836afde146191745ed4c113eb1ce914e9522d005b5

                                                                                                                                        SHA512

                                                                                                                                        52821970450912e88ef2f0da8e6db1573a419bac0843d90403b4af747cded6307831d0f59bf09f77da69c62337a18e87a57b6a28130e92ccb0eba45b0064b834

                                                                                                                                      • C:\Program Files\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        32db1f2df5a3025afc8488fb27033a14

                                                                                                                                        SHA1

                                                                                                                                        a1b5f39cc9f59424438f41b3f293a9ec7acf1564

                                                                                                                                        SHA256

                                                                                                                                        7c0a5420a4847b0be66ae0f0f0277d0deb43b98fd286ba9188af1df9bbce8b19

                                                                                                                                        SHA512

                                                                                                                                        b3dc516ec32fa5f0fa05cc1154dcb19ef2b8621302bf031aa6cabcf3732111c2a00f3896f6425f3fb3183f6a433a5b8071e48a660674c06a91c3ed55ec480652

                                                                                                                                      • C:\Program Files\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        32db1f2df5a3025afc8488fb27033a14

                                                                                                                                        SHA1

                                                                                                                                        a1b5f39cc9f59424438f41b3f293a9ec7acf1564

                                                                                                                                        SHA256

                                                                                                                                        7c0a5420a4847b0be66ae0f0f0277d0deb43b98fd286ba9188af1df9bbce8b19

                                                                                                                                        SHA512

                                                                                                                                        b3dc516ec32fa5f0fa05cc1154dcb19ef2b8621302bf031aa6cabcf3732111c2a00f3896f6425f3fb3183f6a433a5b8071e48a660674c06a91c3ed55ec480652

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1420136871\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        9ed80023db3285af912d99a10e5a334e

                                                                                                                                        SHA1

                                                                                                                                        2a139484d4cbc92e704b6edd0ca0ff4cd6a6267a

                                                                                                                                        SHA256

                                                                                                                                        60822e03d673a9c09c796c6ca9aa5dd5d62a12bc819a8e3dbe3429780d721d62

                                                                                                                                        SHA512

                                                                                                                                        1c9c3608285659881ebbe068be58db3b75e46710f6259b0ae7a4f11821ca105c5d2bfbf6b5968b1dcb1b19a3894d06b4b3d6f77755bc865e78c823f4db1c1f45

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\1420136871\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        9ed80023db3285af912d99a10e5a334e

                                                                                                                                        SHA1

                                                                                                                                        2a139484d4cbc92e704b6edd0ca0ff4cd6a6267a

                                                                                                                                        SHA256

                                                                                                                                        60822e03d673a9c09c796c6ca9aa5dd5d62a12bc819a8e3dbe3429780d721d62

                                                                                                                                        SHA512

                                                                                                                                        1c9c3608285659881ebbe068be58db3b75e46710f6259b0ae7a4f11821ca105c5d2bfbf6b5968b1dcb1b19a3894d06b4b3d6f77755bc865e78c823f4db1c1f45

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5346f66835ee7b10f7fb071ba21d8751

                                                                                                                                        SHA1

                                                                                                                                        d1d68c28ccfd3d8653b5124eea4182542641f3cd

                                                                                                                                        SHA256

                                                                                                                                        5148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113

                                                                                                                                        SHA512

                                                                                                                                        5795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5346f66835ee7b10f7fb071ba21d8751

                                                                                                                                        SHA1

                                                                                                                                        d1d68c28ccfd3d8653b5124eea4182542641f3cd

                                                                                                                                        SHA256

                                                                                                                                        5148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113

                                                                                                                                        SHA512

                                                                                                                                        5795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        3fc71dcb25a3fdc886dfc1872adf8d8a

                                                                                                                                        SHA1

                                                                                                                                        1d184f0c0c042c6735f45e9c28371a9315b97327

                                                                                                                                        SHA256

                                                                                                                                        b830e893152b0ec91afb3330db25baf2b3b79a463676175f307ce186b3206a1f

                                                                                                                                        SHA512

                                                                                                                                        d5802ef6f58d3cc78543e74b3e53e406e3a46ca3df839711c0ce8e7edfbe75238d5de7ae67cbad7d63c9e27d71387e34cff119cfd461db9837f6d9821408dbf1

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5346f66835ee7b10f7fb071ba21d8751

                                                                                                                                        SHA1

                                                                                                                                        d1d68c28ccfd3d8653b5124eea4182542641f3cd

                                                                                                                                        SHA256

                                                                                                                                        5148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113

                                                                                                                                        SHA512

                                                                                                                                        5795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5346f66835ee7b10f7fb071ba21d8751

                                                                                                                                        SHA1

                                                                                                                                        d1d68c28ccfd3d8653b5124eea4182542641f3cd

                                                                                                                                        SHA256

                                                                                                                                        5148eb0be343708600700cba201ff6bd4f62b5e9cdef9da5cb9290b87fb03113

                                                                                                                                        SHA512

                                                                                                                                        5795b7e3f1283e60a73a1aca24935136d4a1ca5c0aff455f05112e2b429d01941cb5733e72e91d9331a882e17b5b07dfdbd3e9ce2ad84f60698691fdfe2f6003

                                                                                                                                      • C:\Users\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        d60ade52b457c5c3f7c9e240f76ed4bd

                                                                                                                                        SHA1

                                                                                                                                        d157b8ba971c4f118ee543e76d60b12757ba4f0d

                                                                                                                                        SHA256

                                                                                                                                        48b074eddac5c3648bc85e5091c40f4573c0fee812781dbdd6b0d1b4758c85e5

                                                                                                                                        SHA512

                                                                                                                                        f0f8aa7d231d837bbfef4a678ad12c8762ec361f120305d23b0309383f6d951bac74aec13b8dfe519ab281c2b0084683221b481346b7f783e39774d8d6fce9d1

                                                                                                                                      • C:\Users\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        d60ade52b457c5c3f7c9e240f76ed4bd

                                                                                                                                        SHA1

                                                                                                                                        d157b8ba971c4f118ee543e76d60b12757ba4f0d

                                                                                                                                        SHA256

                                                                                                                                        48b074eddac5c3648bc85e5091c40f4573c0fee812781dbdd6b0d1b4758c85e5

                                                                                                                                        SHA512

                                                                                                                                        f0f8aa7d231d837bbfef4a678ad12c8762ec361f120305d23b0309383f6d951bac74aec13b8dfe519ab281c2b0084683221b481346b7f783e39774d8d6fce9d1

                                                                                                                                      • C:\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5e16005b16eb143942210b9485832aea

                                                                                                                                        SHA1

                                                                                                                                        5f764626a16e006f5978ffd3284cf4c0275ac03b

                                                                                                                                        SHA256

                                                                                                                                        f67a5c882c4d69764a701322970dec872e7b7f7497567a509e36a5a4f4ca9226

                                                                                                                                        SHA512

                                                                                                                                        675df684f66ccd2085d52c5c2c87c467eb58798797cce2481b330bc2cbc757e510ed590919dbe69a7c2524f8857f1599d991f515ba5e58c54a1d6360e4a3913a

                                                                                                                                      • C:\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        5e16005b16eb143942210b9485832aea

                                                                                                                                        SHA1

                                                                                                                                        5f764626a16e006f5978ffd3284cf4c0275ac03b

                                                                                                                                        SHA256

                                                                                                                                        f67a5c882c4d69764a701322970dec872e7b7f7497567a509e36a5a4f4ca9226

                                                                                                                                        SHA512

                                                                                                                                        675df684f66ccd2085d52c5c2c87c467eb58798797cce2481b330bc2cbc757e510ed590919dbe69a7c2524f8857f1599d991f515ba5e58c54a1d6360e4a3913a

                                                                                                                                      • C:\odt\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        f8cf8e1433e035c2277b8989ab42e70d

                                                                                                                                        SHA1

                                                                                                                                        f2e1a989c5a4f0277e50036791df82a83ba5e2fd

                                                                                                                                        SHA256

                                                                                                                                        4c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500

                                                                                                                                        SHA512

                                                                                                                                        cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6

                                                                                                                                      • C:\odt\backup.exe

                                                                                                                                        Filesize

                                                                                                                                        72KB

                                                                                                                                        MD5

                                                                                                                                        f8cf8e1433e035c2277b8989ab42e70d

                                                                                                                                        SHA1

                                                                                                                                        f2e1a989c5a4f0277e50036791df82a83ba5e2fd

                                                                                                                                        SHA256

                                                                                                                                        4c91cbc577d99a2facd628cf867a7ddb1ffa29655bf33f9bc0d0a9520d300500

                                                                                                                                        SHA512

                                                                                                                                        cddcf449e1a882a6286c2d4c0c14df282aaf7eb51443daf06d0e1c8cba67aba16b738d6f42f2737c5a0126ededc66965c61de7ab26aa78a61bd8b3df25e1b0b6