Overview

overview

10

Static

static

50c5bb084e...47.exe

windows7-x64

10

50c5bb084e...47.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    169s
  • max time network
    196s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 20:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    50c5bb084e877958fcb86d85afca56ecf24122af6c2b9fc2d0b3c5a2c4862a47.exe

  • Size

    72KB

  • MD5

    c168452ef528b48047103d7c494113b9

  • SHA1

    84967801995c8d330052ff4c694184c25da41a80

  • SHA256

    50c5bb084e877958fcb86d85afca56ecf24122af6c2b9fc2d0b3c5a2c4862a47

  • SHA512

    f99d7eab05fc646290c9a65eea91d7fddafa2cf5661eec179b0acff4cbcbfe474050ba74640111c616d989bd024a8ba82dc7aa446cc9c37ad02bb74e33e31fdd

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2E:ipQNwC3BEddsEqOt/hyJF+x3BEJwRro

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 14 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\50c5bb084e877958fcb86d85afca56ecf24122af6c2b9fc2d0b3c5a2c4862a47.exe
    "C:\Users\Admin\AppData\Local\Temp\50c5bb084e877958fcb86d85afca56ecf24122af6c2b9fc2d0b3c5a2c4862a47.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Local\Temp\3741745895\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3741745895\backup.exe C:\Users\Admin\AppData\Local\Temp\3741745895\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:896
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4628
        • C:\odt\System Restore.exe
          "C:\odt\System Restore.exe" C:\odt\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2600
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1316
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2716
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1912
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4488
          • C:\Program Files\Common Files\data.exe
            "C:\Program Files\Common Files\data.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1340
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:3428
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:4472
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3348
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:392
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1876
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1420
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3668
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3640
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1824
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1124
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:784
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:744
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1452
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4488
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1640
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:1360
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                    PID:2680
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:3096
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Drops file in Program Files directory
                    • System policy modification
                    PID:2776
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:2324
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                      9⤵
                      • System policy modification
                      PID:940
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:864
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:4860
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                      • Disables RegEdit via registry modification
                      PID:4220
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:2104
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                      9⤵
                      • Disables RegEdit via registry modification
                      PID:4412
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:1916
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                      9⤵
                      • System policy modification
                      PID:4136
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                      9⤵
                      • System policy modification
                      PID:1816
                  • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1224
                  • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                    8⤵
                      PID:4168
                    • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:1992
                    • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:1704
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\System Restore.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                    7⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1224
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:5052
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4312
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:1056
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                      8⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:4840
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\update.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                      8⤵
                        PID:664
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:4644
                    • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:2708
                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe
                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:3928
                    • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4156
                    • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:4316
                    • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:456
                    • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                      7⤵
                        PID:1072
                        • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:4564
                      • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                        7⤵
                          PID:2184
                          • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:1928
                        • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • System policy modification
                          PID:1552
                        • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                          7⤵
                            PID:4228
                          • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                            7⤵
                              PID:4328
                              • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\data.exe
                                "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\data.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                8⤵
                                • Disables RegEdit via registry modification
                                • System policy modification
                                PID:5088
                                • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                  9⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:4676
                          • C:\Program Files\Common Files\Services\backup.exe
                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                            6⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4652
                          • C:\Program Files\Common Files\System\backup.exe
                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1412
                            • C:\Program Files\Common Files\System\ado\backup.exe
                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                              7⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              PID:3108
                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:2532
                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2744
                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                8⤵
                                  PID:1808
                                • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                  "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                  8⤵
                                    PID:2884
                                  • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:3684
                                  • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    PID:1484
                                • C:\Program Files\Common Files\System\de-DE\backup.exe
                                  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                  7⤵
                                  • System policy modification
                                  PID:3944
                                • C:\Program Files\Common Files\System\es-ES\backup.exe
                                  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                  7⤵
                                    PID:1876
                                  • C:\Program Files\Common Files\System\en-US\backup.exe
                                    "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                    7⤵
                                    • System policy modification
                                    PID:1468
                                  • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    PID:2732
                                  • C:\Program Files\Common Files\System\it-IT\data.exe
                                    "C:\Program Files\Common Files\System\it-IT\data.exe" C:\Program Files\Common Files\System\it-IT\
                                    7⤵
                                      PID:3228
                                    • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                      7⤵
                                        PID:4088
                                      • C:\Program Files\Common Files\System\msadc\backup.exe
                                        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                        7⤵
                                        • Drops file in Program Files directory
                                        • System policy modification
                                        PID:2028
                                        • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          PID:1208
                                        • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:364
                                        • C:\Program Files\Common Files\System\msadc\es-ES\update.exe
                                          "C:\Program Files\Common Files\System\msadc\es-ES\update.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                          8⤵
                                            PID:3668
                                          • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                            8⤵
                                            • System policy modification
                                            PID:712
                                          • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                            "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                            8⤵
                                              PID:3748
                                            • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                              8⤵
                                                PID:3016
                                            • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                              "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                              7⤵
                                              • Disables RegEdit via registry modification
                                              • Drops file in Program Files directory
                                              PID:2184
                                              • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                8⤵
                                                  PID:3612
                                                • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                  8⤵
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:452
                                          • C:\Program Files\Google\backup.exe
                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                            5⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:2240
                                            • C:\Program Files\Google\Chrome\backup.exe
                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                              6⤵
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:4168
                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                7⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1688
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:2020
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                    9⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:3696
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                    9⤵
                                                      PID:5040
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                      9⤵
                                                      • System policy modification
                                                      PID:3972
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                      9⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:3144
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                      9⤵
                                                        PID:400
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                        9⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        PID:3136
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                        9⤵
                                                        • Disables RegEdit via registry modification
                                                        • System policy modification
                                                        PID:2272
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                        9⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        PID:5116
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                          10⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Drops file in Program Files directory
                                                          PID:3216
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                            11⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:1660
                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                      8⤵
                                                      • System policy modification
                                                      PID:1308
                                              • C:\Program Files\Internet Explorer\backup.exe
                                                "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                5⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:932
                                                • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                  "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:3448
                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                  6⤵
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:364
                                                • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:840
                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                  6⤵
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  PID:1300
                                                • C:\Program Files\Internet Explorer\images\backup.exe
                                                  "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                  6⤵
                                                    PID:4956
                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:4688
                                                  • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                    "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                    6⤵
                                                      PID:1216
                                                    • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                      "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      PID:1916
                                                  • C:\Program Files\Java\backup.exe
                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                    5⤵
                                                      PID:4504
                                                      • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                        6⤵
                                                        • Disables RegEdit via registry modification
                                                        • Drops file in Program Files directory
                                                        • System policy modification
                                                        PID:4092
                                                        • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                          7⤵
                                                            PID:4876
                                                            • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                              8⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:2900
                                                            • C:\Program Files\Java\jdk1.8.0_66\db\lib\update.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\db\lib\update.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              PID:1244
                                                          • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • System policy modification
                                                            PID:2580
                                                            • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                              8⤵
                                                                PID:216
                                                                • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                  9⤵
                                                                  • System policy modification
                                                                  PID:544
                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:4912
                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:2800
                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                  9⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:4804
                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                  9⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:4108
                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                  9⤵
                                                                    PID:1056
                                                            • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                              "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:4952
                                                          • C:\Program Files\Microsoft Office\backup.exe
                                                            "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                            5⤵
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            PID:2568
                                                            • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                              "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                              6⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:4560
                                                            • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                              "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                              6⤵
                                                                PID:1764
                                                          • C:\Program Files (x86)\backup.exe
                                                            "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                            4⤵
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:332
                                                            • C:\Program Files (x86)\Adobe\System Restore.exe
                                                              "C:\Program Files (x86)\Adobe\System Restore.exe" C:\Program Files (x86)\Adobe\
                                                              5⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:868
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                6⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:3164
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1832
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                  7⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • Drops file in Program Files directory
                                                                  PID:4576
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                    8⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:4004
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                      9⤵
                                                                        PID:1240
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                      8⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:4212
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                        9⤵
                                                                          PID:3140
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                        8⤵
                                                                          PID:3664
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          PID:2244
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:1200
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                            9⤵
                                                                              PID:1436
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:3752
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                              9⤵
                                                                                PID:3912
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                              8⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • System policy modification
                                                                              PID:5044
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:5012
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                9⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:3740
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                              8⤵
                                                                              • System policy modification
                                                                              PID:1360
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                9⤵
                                                                                • System policy modification
                                                                                PID:1356
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                              8⤵
                                                                                PID:3684
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                              7⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:5052
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                8⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:3364
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                8⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • System policy modification
                                                                                PID:4656
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                8⤵
                                                                                • System policy modification
                                                                                PID:2884
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                  9⤵
                                                                                  • Drops file in Program Files directory
                                                                                  • System policy modification
                                                                                  PID:1288
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                    10⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • System policy modification
                                                                                    PID:4004
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                    10⤵
                                                                                    • Drops file in Program Files directory
                                                                                    • System policy modification
                                                                                    PID:4348
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                      11⤵
                                                                                        PID:3764
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                        11⤵
                                                                                        • System policy modification
                                                                                        PID:2308
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                        11⤵
                                                                                        • System policy modification
                                                                                        PID:3664
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                7⤵
                                                                                  PID:3556
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                    8⤵
                                                                                      PID:444
                                                                              • C:\Program Files (x86)\Common Files\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                5⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Drops file in Program Files directory
                                                                                PID:5036
                                                                                • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                  6⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Program Files directory
                                                                                  PID:1316
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Drops file in Program Files directory
                                                                                    PID:924
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                    7⤵
                                                                                    • System policy modification
                                                                                    PID:2820
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                      8⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:2380
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Drops file in Program Files directory
                                                                                    PID:2348
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                      8⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:2948
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                    7⤵
                                                                                      PID:1216
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                        8⤵
                                                                                        • Drops file in Program Files directory
                                                                                        PID:940
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                          9⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:4356
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\System Restore.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                            10⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:4984
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                            10⤵
                                                                                              PID:4512
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                11⤵
                                                                                                  PID:4764
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                  11⤵
                                                                                                    PID:1004
                                                                                        • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                          6⤵
                                                                                            PID:2596
                                                                                        • C:\Program Files (x86)\Google\backup.exe
                                                                                          "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                          5⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Drops file in Program Files directory
                                                                                          PID:920
                                                                                          • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                            "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                            6⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:3844
                                                                                          • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                            "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                            6⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:2564
                                                                                      • C:\Users\backup.exe
                                                                                        C:\Users\backup.exe C:\Users\
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:1460
                                                                                        • C:\Users\Admin\backup.exe
                                                                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                          5⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:3200
                                                                                          • C:\Users\Admin\3D Objects\backup.exe
                                                                                            "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4788
                                                                                          • C:\Users\Admin\Contacts\backup.exe
                                                                                            C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:4680
                                                                                          • C:\Users\Admin\Desktop\backup.exe
                                                                                            C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                            6⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:3920
                                                                                          • C:\Users\Admin\Documents\backup.exe
                                                                                            C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                            6⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:5044
                                                                                          • C:\Users\Admin\Downloads\backup.exe
                                                                                            C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                            6⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:2252
                                                                                          • C:\Users\Admin\Favorites\backup.exe
                                                                                            C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                            6⤵
                                                                                              PID:1256
                                                                                            • C:\Users\Admin\Links\backup.exe
                                                                                              C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                              6⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • System policy modification
                                                                                              PID:4984
                                                                                            • C:\Users\Admin\Music\data.exe
                                                                                              C:\Users\Admin\Music\data.exe C:\Users\Admin\Music\
                                                                                              6⤵
                                                                                                PID:508
                                                                                              • C:\Users\Admin\OneDrive\backup.exe
                                                                                                C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                6⤵
                                                                                                  PID:3592
                                                                                                • C:\Users\Admin\Pictures\backup.exe
                                                                                                  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                  6⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • System policy modification
                                                                                                  PID:2152
                                                                                                  • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                    "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                    7⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:4136
                                                                                                  • C:\Users\Admin\Pictures\Saved Pictures\System Restore.exe
                                                                                                    "C:\Users\Admin\Pictures\Saved Pictures\System Restore.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                    7⤵
                                                                                                      PID:552
                                                                                                  • C:\Users\Admin\Saved Games\backup.exe
                                                                                                    "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                    6⤵
                                                                                                      PID:3972
                                                                                                    • C:\Users\Admin\Searches\backup.exe
                                                                                                      C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                      6⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:1700
                                                                                                    • C:\Users\Admin\Videos\backup.exe
                                                                                                      C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                      6⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      PID:3392
                                                                                                  • C:\Users\Public\backup.exe
                                                                                                    C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                    5⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:4240
                                                                                                    • C:\Users\Public\Documents\update.exe
                                                                                                      C:\Users\Public\Documents\update.exe C:\Users\Public\Documents\
                                                                                                      6⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:2984
                                                                                                    • C:\Users\Public\Downloads\backup.exe
                                                                                                      C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                      6⤵
                                                                                                      • System policy modification
                                                                                                      PID:5012
                                                                                                    • C:\Users\Public\Music\backup.exe
                                                                                                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                      6⤵
                                                                                                        PID:3080
                                                                                                      • C:\Users\Public\Pictures\backup.exe
                                                                                                        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                        6⤵
                                                                                                        • System policy modification
                                                                                                        PID:4652
                                                                                                      • C:\Users\Public\Videos\backup.exe
                                                                                                        C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                        6⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • System policy modification
                                                                                                        PID:2596
                                                                                                  • C:\Windows\backup.exe
                                                                                                    C:\Windows\backup.exe C:\Windows\
                                                                                                    4⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:4400
                                                                                                    • C:\Windows\addins\backup.exe
                                                                                                      C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                      5⤵
                                                                                                        PID:1836
                                                                                                      • C:\Windows\appcompat\backup.exe
                                                                                                        C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                        5⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:456
                                                                                                        • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                          C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                          6⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          PID:3212
                                                                                                          • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                            C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                            7⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:2024
                                                                                                        • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                          C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                          6⤵
                                                                                                            PID:1004
                                                                                                          • C:\Windows\appcompat\Programs\backup.exe
                                                                                                            C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                            6⤵
                                                                                                              PID:1548
                                                                                                          • C:\Windows\apppatch\backup.exe
                                                                                                            C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                            5⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • System policy modification
                                                                                                            PID:1468
                                                                                                            • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                              C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                              6⤵
                                                                                                              • System policy modification
                                                                                                              PID:3132
                                                                                                            • C:\Windows\apppatch\Custom\backup.exe
                                                                                                              C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                              6⤵
                                                                                                              • Drops file in Windows directory
                                                                                                              PID:2360
                                                                                                              • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                7⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:1664
                                                                                                            • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                              C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                              6⤵
                                                                                                                PID:5060
                                                                                                              • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                6⤵
                                                                                                                  PID:3644
                                                                                                                • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                  C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                  6⤵
                                                                                                                    PID:848
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1772
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • System policy modification
                                                                                                            PID:4848
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2528
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                            2⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:4704
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                            2⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • System policy modification
                                                                                                            PID:308
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • System policy modification
                                                                                                            PID:3552
                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                          1⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:4912
                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                          1⤵
                                                                                                            PID:712

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\PerfLogs\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            10ec4ca61beec61a00137eb610d05e55

                                                                                                            SHA1

                                                                                                            4bffbbe569115d37e4ecbd7895123bdae2d3d33b

                                                                                                            SHA256

                                                                                                            b0880f645921910f21a536494370917af7eb53b68cf207ab746fb53a56316643

                                                                                                            SHA512

                                                                                                            0bda31422baf5d82d1c60552adaa0a839615521f61967f8861c0d21994c923c7eba2ecc6d97c6af473a398219d37216364aad722c931b9008955c249ed11cb92

                                                                                                            Download Submit

                                                                                                          • C:\PerfLogs\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            10ec4ca61beec61a00137eb610d05e55

                                                                                                            SHA1

                                                                                                            4bffbbe569115d37e4ecbd7895123bdae2d3d33b

                                                                                                            SHA256

                                                                                                            b0880f645921910f21a536494370917af7eb53b68cf207ab746fb53a56316643

                                                                                                            SHA512

                                                                                                            0bda31422baf5d82d1c60552adaa0a839615521f61967f8861c0d21994c923c7eba2ecc6d97c6af473a398219d37216364aad722c931b9008955c249ed11cb92

                                                                                                            Download Submit

                                                                                                          • C:\Program Files (x86)\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            290245f5b41dac81e2a5a26e70069a07

                                                                                                            SHA1

                                                                                                            cf8cdfd84d716c7d34425efb5e822e47740b7b04

                                                                                                            SHA256

                                                                                                            44e8708796db04f99fed40a205ca5cbb5001e9282d1b6d8a4063c4c125222bef

                                                                                                            SHA512

                                                                                                            620d077929077978624573127dd859f26b9a8304e025971d598798ea6a65bbb0d07380a925dc1cd603b5cb1d86fff5b8b5f23c54d736ce2c803e993a34ef3c35

                                                                                                            Download Submit

                                                                                                          • C:\Program Files (x86)\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            290245f5b41dac81e2a5a26e70069a07

                                                                                                            SHA1

                                                                                                            cf8cdfd84d716c7d34425efb5e822e47740b7b04

                                                                                                            SHA256

                                                                                                            44e8708796db04f99fed40a205ca5cbb5001e9282d1b6d8a4063c4c125222bef

                                                                                                            SHA512

                                                                                                            620d077929077978624573127dd859f26b9a8304e025971d598798ea6a65bbb0d07380a925dc1cd603b5cb1d86fff5b8b5f23c54d736ce2c803e993a34ef3c35

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a422a7217299c2d1fedeb61c82c2d300

                                                                                                            SHA1

                                                                                                            12a29f9d0dc85ae45262b26b6e2c8edae7f746ed

                                                                                                            SHA256

                                                                                                            fc0cc0d4d9d013b987840df03f3506fb7db6f045c41986754923f89f2b78fd76

                                                                                                            SHA512

                                                                                                            bf3729713e3354a0ade05ec81c3056612e0d3e7b83d3676b4c7abee00f6dca928d0465e38979495d54b35318347f3140ad7cc666bf1feb55655674bff78d9014

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a422a7217299c2d1fedeb61c82c2d300

                                                                                                            SHA1

                                                                                                            12a29f9d0dc85ae45262b26b6e2c8edae7f746ed

                                                                                                            SHA256

                                                                                                            fc0cc0d4d9d013b987840df03f3506fb7db6f045c41986754923f89f2b78fd76

                                                                                                            SHA512

                                                                                                            bf3729713e3354a0ade05ec81c3056612e0d3e7b83d3676b4c7abee00f6dca928d0465e38979495d54b35318347f3140ad7cc666bf1feb55655674bff78d9014

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\7-Zip\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            e6dcbf8bd3d83d3755b5bd92603ba5a8

                                                                                                            SHA1

                                                                                                            92f2ac85079598ad7ae1de7841a33fab138fe625

                                                                                                            SHA256

                                                                                                            790c7ec97f1bbd040606c459e92c20d0e0d1abcd662c9bd29cf6966c22e86fe1

                                                                                                            SHA512

                                                                                                            6fbebf23a9f2273f54e06775d5c062f64ca1098464e28e21c7470510b0c78e988a34f306d034a27036c4fe12d3d872ff9e0d9ad5f9c72f6948b452865a41ab96

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\7-Zip\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            e6dcbf8bd3d83d3755b5bd92603ba5a8

                                                                                                            SHA1

                                                                                                            92f2ac85079598ad7ae1de7841a33fab138fe625

                                                                                                            SHA256

                                                                                                            790c7ec97f1bbd040606c459e92c20d0e0d1abcd662c9bd29cf6966c22e86fe1

                                                                                                            SHA512

                                                                                                            6fbebf23a9f2273f54e06775d5c062f64ca1098464e28e21c7470510b0c78e988a34f306d034a27036c4fe12d3d872ff9e0d9ad5f9c72f6948b452865a41ab96

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            16036f10a086a5fb38df5eef4833e83f

                                                                                                            SHA1

                                                                                                            9678b2709fa963a890ae0e72713161cb5608c2e2

                                                                                                            SHA256

                                                                                                            ca1b24d6c8ab57179829fdb4332900bffeb538b6faf72209e188d40bb167a7ad

                                                                                                            SHA512

                                                                                                            4217f688ea71d82bf4ab87b8049c3210e4f6efa24465f1fc8e3fbe4c71f489fdad3bb17099c0c265b108ae4a294e38f87a530f5d30d14f336e48ed3ccabd637d

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            16036f10a086a5fb38df5eef4833e83f

                                                                                                            SHA1

                                                                                                            9678b2709fa963a890ae0e72713161cb5608c2e2

                                                                                                            SHA256

                                                                                                            ca1b24d6c8ab57179829fdb4332900bffeb538b6faf72209e188d40bb167a7ad

                                                                                                            SHA512

                                                                                                            4217f688ea71d82bf4ab87b8049c3210e4f6efa24465f1fc8e3fbe4c71f489fdad3bb17099c0c265b108ae4a294e38f87a530f5d30d14f336e48ed3ccabd637d

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\Services\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6f791faafdf7424180c2e2e2e5d40a21

                                                                                                            SHA1

                                                                                                            f599a6d1881476c3060dd304c1d00715b620bf50

                                                                                                            SHA256

                                                                                                            24f5de1913c5c7e706a1c232c50e8a96c313f1d184cdbded3735f410fcaf70a7

                                                                                                            SHA512

                                                                                                            5e235ffa17364d13943f633da00a27770d0f9ffb997514e34342fcb50d401247060d63f2aef31c9571314c5e9d1301400054229795499761f0d07ce143625bbe

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\Services\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6f791faafdf7424180c2e2e2e5d40a21

                                                                                                            SHA1

                                                                                                            f599a6d1881476c3060dd304c1d00715b620bf50

                                                                                                            SHA256

                                                                                                            24f5de1913c5c7e706a1c232c50e8a96c313f1d184cdbded3735f410fcaf70a7

                                                                                                            SHA512

                                                                                                            5e235ffa17364d13943f633da00a27770d0f9ffb997514e34342fcb50d401247060d63f2aef31c9571314c5e9d1301400054229795499761f0d07ce143625bbe

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\System\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            1cd953f54447d4b0453bb9c826048579

                                                                                                            SHA1

                                                                                                            23c93035cd90b577f1533497bb182cc1b924ca87

                                                                                                            SHA256

                                                                                                            554495deae06ee8dd9dabfb48e81ec819fbe9927b73a0573794b6bfd384c9a49

                                                                                                            SHA512

                                                                                                            85860239ee2b71da5078684d4dfdafefaee41ddc3872ccd1de4f2f7406a3a0034f23d451e7ac83e2d1e8f75e7e9f6736317beaaef4a06e08bc50913ee88d2774

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\System\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            1cd953f54447d4b0453bb9c826048579

                                                                                                            SHA1

                                                                                                            23c93035cd90b577f1533497bb182cc1b924ca87

                                                                                                            SHA256

                                                                                                            554495deae06ee8dd9dabfb48e81ec819fbe9927b73a0573794b6bfd384c9a49

                                                                                                            SHA512

                                                                                                            85860239ee2b71da5078684d4dfdafefaee41ddc3872ccd1de4f2f7406a3a0034f23d451e7ac83e2d1e8f75e7e9f6736317beaaef4a06e08bc50913ee88d2774

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\data.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            bdc5ef7e41b823e640f0b22092776430

                                                                                                            SHA1

                                                                                                            f04ecd70defb1e3c2cc97f9ab548b8aee54ac60f

                                                                                                            SHA256

                                                                                                            4dd1d41875d43eb76237a64717836db88c1f1412c824f3ac12704afb80a50911

                                                                                                            SHA512

                                                                                                            81e68990f14692844f404818e303217f99655876f6e13662ba74e05120511548f04610037a7266b53563f5289079c40af970353d2fc9858cec7f25e982437bbb

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\data.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            bdc5ef7e41b823e640f0b22092776430

                                                                                                            SHA1

                                                                                                            f04ecd70defb1e3c2cc97f9ab548b8aee54ac60f

                                                                                                            SHA256

                                                                                                            4dd1d41875d43eb76237a64717836db88c1f1412c824f3ac12704afb80a50911

                                                                                                            SHA512

                                                                                                            81e68990f14692844f404818e303217f99655876f6e13662ba74e05120511548f04610037a7266b53563f5289079c40af970353d2fc9858cec7f25e982437bbb

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            4bd2298105b0e140cad302af8dd230c4

                                                                                                            SHA1

                                                                                                            de5491743bb629515bce796746500a1814a9b207

                                                                                                            SHA256

                                                                                                            75ea1ac2ef28ad30b5aada0989af2d30542c0b6e8fbf6de0383adecc07535378

                                                                                                            SHA512

                                                                                                            ad44000e027e81f89437bb5de2c0c92ab547ed0bba0a666aba7aaeca5783efc8683495c5a6b90f62f486d1601db7b10821aebd1131b44e2c4e0dfb13cc93804a

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            4bd2298105b0e140cad302af8dd230c4

                                                                                                            SHA1

                                                                                                            de5491743bb629515bce796746500a1814a9b207

                                                                                                            SHA256

                                                                                                            75ea1ac2ef28ad30b5aada0989af2d30542c0b6e8fbf6de0383adecc07535378

                                                                                                            SHA512

                                                                                                            ad44000e027e81f89437bb5de2c0c92ab547ed0bba0a666aba7aaeca5783efc8683495c5a6b90f62f486d1601db7b10821aebd1131b44e2c4e0dfb13cc93804a

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\System Restore.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            dc84930a943467cd4ca50d7d5f6556e1

                                                                                                            SHA1

                                                                                                            0174714123b202c9f415020b630268da31c13e92

                                                                                                            SHA256

                                                                                                            99ddce562d44fd19e9379a49497b4dac5b13ecdc22bf33bcd6e45fddf6bcab81

                                                                                                            SHA512

                                                                                                            338758478a35c9e629987c1f967b2c051d62b4ef56748b4a30832f32f5114f891c8f7e69688dd14c57617fa4af70a52b792312038a7ae3e9a041eebf38198f25

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\System Restore.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            dc84930a943467cd4ca50d7d5f6556e1

                                                                                                            SHA1

                                                                                                            0174714123b202c9f415020b630268da31c13e92

                                                                                                            SHA256

                                                                                                            99ddce562d44fd19e9379a49497b4dac5b13ecdc22bf33bcd6e45fddf6bcab81

                                                                                                            SHA512

                                                                                                            338758478a35c9e629987c1f967b2c051d62b4ef56748b4a30832f32f5114f891c8f7e69688dd14c57617fa4af70a52b792312038a7ae3e9a041eebf38198f25

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c84b09c341c86affc1678056f2f0ecda

                                                                                                            SHA1

                                                                                                            be6364640db83321d5cc50dc92667f018dca26a2

                                                                                                            SHA256

                                                                                                            ddb65029e2a9fb01aa206afb8a5bcfbe7abc3ea5320630423f741d9676f9e5e6

                                                                                                            SHA512

                                                                                                            b53852feaa7ca7b3eab9b323f5e7d308d198e785377bae7e5c7bb16ed5a2c02036501b54e7507ad4e5d25538bba10d369f17855edb3e708e00ca11fd90747c42

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c84b09c341c86affc1678056f2f0ecda

                                                                                                            SHA1

                                                                                                            be6364640db83321d5cc50dc92667f018dca26a2

                                                                                                            SHA256

                                                                                                            ddb65029e2a9fb01aa206afb8a5bcfbe7abc3ea5320630423f741d9676f9e5e6

                                                                                                            SHA512

                                                                                                            b53852feaa7ca7b3eab9b323f5e7d308d198e785377bae7e5c7bb16ed5a2c02036501b54e7507ad4e5d25538bba10d369f17855edb3e708e00ca11fd90747c42

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            ab46a7164eb2dd1cfb6a0dd64b11664d

                                                                                                            SHA1

                                                                                                            416b5747e20b37d76a4eddf75703d525db35117c

                                                                                                            SHA256

                                                                                                            84ac0831e9cd9a56e0750a59eda49683c7d7766fb01dbf83c25a376a881b5946

                                                                                                            SHA512

                                                                                                            f9a47e1861b3a16f885e43ea66aff408848813083036f85c78e565ce0f3c46b9f5e028c86974c8d778b3ea4096adb36b6278e0cea3457ad1478bf48cda7d9396

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            ab46a7164eb2dd1cfb6a0dd64b11664d

                                                                                                            SHA1

                                                                                                            416b5747e20b37d76a4eddf75703d525db35117c

                                                                                                            SHA256

                                                                                                            84ac0831e9cd9a56e0750a59eda49683c7d7766fb01dbf83c25a376a881b5946

                                                                                                            SHA512

                                                                                                            f9a47e1861b3a16f885e43ea66aff408848813083036f85c78e565ce0f3c46b9f5e028c86974c8d778b3ea4096adb36b6278e0cea3457ad1478bf48cda7d9396

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5f634dac6baa561172dad7c7f9ff3e58

                                                                                                            SHA1

                                                                                                            0b2217a83017ea3213e9d013654009856861f202

                                                                                                            SHA256

                                                                                                            befa808ed8fcdabdd724ca94df6718681f6ebdbd6a1556b7a33619c02da0b0c0

                                                                                                            SHA512

                                                                                                            efb46cbff90aa2c516eece33afd33a33800565c0346ae74fb09c734e08115999c7ea6c1041e625abcaf88c7a3ecefb750a63e87696599f06db5816a774994e88

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5f634dac6baa561172dad7c7f9ff3e58

                                                                                                            SHA1

                                                                                                            0b2217a83017ea3213e9d013654009856861f202

                                                                                                            SHA256

                                                                                                            befa808ed8fcdabdd724ca94df6718681f6ebdbd6a1556b7a33619c02da0b0c0

                                                                                                            SHA512

                                                                                                            efb46cbff90aa2c516eece33afd33a33800565c0346ae74fb09c734e08115999c7ea6c1041e625abcaf88c7a3ecefb750a63e87696599f06db5816a774994e88

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a83501f6d2e67f783b38e02c652464ed

                                                                                                            SHA1

                                                                                                            e69e6b772cd2b42d7b5f7fd007c3154d30d157f6

                                                                                                            SHA256

                                                                                                            fad8b6a11b6adddaefded040f26f2784553cc5d3101a5e2cbb6060cffb2fbf91

                                                                                                            SHA512

                                                                                                            2780c203bc16c56ffae2a47fc3aa17c0cba6773ac8e83bcb88002ba59e96e64762029934933ffa3a8f2b312c228c04955395834580db5c4bc2c11da02ac4ce33

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a83501f6d2e67f783b38e02c652464ed

                                                                                                            SHA1

                                                                                                            e69e6b772cd2b42d7b5f7fd007c3154d30d157f6

                                                                                                            SHA256

                                                                                                            fad8b6a11b6adddaefded040f26f2784553cc5d3101a5e2cbb6060cffb2fbf91

                                                                                                            SHA512

                                                                                                            2780c203bc16c56ffae2a47fc3aa17c0cba6773ac8e83bcb88002ba59e96e64762029934933ffa3a8f2b312c228c04955395834580db5c4bc2c11da02ac4ce33

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5f634dac6baa561172dad7c7f9ff3e58

                                                                                                            SHA1

                                                                                                            0b2217a83017ea3213e9d013654009856861f202

                                                                                                            SHA256

                                                                                                            befa808ed8fcdabdd724ca94df6718681f6ebdbd6a1556b7a33619c02da0b0c0

                                                                                                            SHA512

                                                                                                            efb46cbff90aa2c516eece33afd33a33800565c0346ae74fb09c734e08115999c7ea6c1041e625abcaf88c7a3ecefb750a63e87696599f06db5816a774994e88

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5f634dac6baa561172dad7c7f9ff3e58

                                                                                                            SHA1

                                                                                                            0b2217a83017ea3213e9d013654009856861f202

                                                                                                            SHA256

                                                                                                            befa808ed8fcdabdd724ca94df6718681f6ebdbd6a1556b7a33619c02da0b0c0

                                                                                                            SHA512

                                                                                                            efb46cbff90aa2c516eece33afd33a33800565c0346ae74fb09c734e08115999c7ea6c1041e625abcaf88c7a3ecefb750a63e87696599f06db5816a774994e88

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            aedbadda0ec5c16579979a4f56cae123

                                                                                                            SHA1

                                                                                                            c29931688e4fc1421363eb7cd8acf8c6770ec36d

                                                                                                            SHA256

                                                                                                            964386d700918d9d89c2f1c1f8bf562bfbac8f9979e0ad420d3fd2fa9f2f9ce5

                                                                                                            SHA512

                                                                                                            5ff8700cf027804492cfc90d32cd730a4e421743e79df386dec743b26b5652e0453ab1798e0dda5bf6772d9804e4acecb69984e56e522f4a3f49951408afb330

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            aedbadda0ec5c16579979a4f56cae123

                                                                                                            SHA1

                                                                                                            c29931688e4fc1421363eb7cd8acf8c6770ec36d

                                                                                                            SHA256

                                                                                                            964386d700918d9d89c2f1c1f8bf562bfbac8f9979e0ad420d3fd2fa9f2f9ce5

                                                                                                            SHA512

                                                                                                            5ff8700cf027804492cfc90d32cd730a4e421743e79df386dec743b26b5652e0453ab1798e0dda5bf6772d9804e4acecb69984e56e522f4a3f49951408afb330

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            aedbadda0ec5c16579979a4f56cae123

                                                                                                            SHA1

                                                                                                            c29931688e4fc1421363eb7cd8acf8c6770ec36d

                                                                                                            SHA256

                                                                                                            964386d700918d9d89c2f1c1f8bf562bfbac8f9979e0ad420d3fd2fa9f2f9ce5

                                                                                                            SHA512

                                                                                                            5ff8700cf027804492cfc90d32cd730a4e421743e79df386dec743b26b5652e0453ab1798e0dda5bf6772d9804e4acecb69984e56e522f4a3f49951408afb330

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            aedbadda0ec5c16579979a4f56cae123

                                                                                                            SHA1

                                                                                                            c29931688e4fc1421363eb7cd8acf8c6770ec36d

                                                                                                            SHA256

                                                                                                            964386d700918d9d89c2f1c1f8bf562bfbac8f9979e0ad420d3fd2fa9f2f9ce5

                                                                                                            SHA512

                                                                                                            5ff8700cf027804492cfc90d32cd730a4e421743e79df386dec743b26b5652e0453ab1798e0dda5bf6772d9804e4acecb69984e56e522f4a3f49951408afb330

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            aedbadda0ec5c16579979a4f56cae123

                                                                                                            SHA1

                                                                                                            c29931688e4fc1421363eb7cd8acf8c6770ec36d

                                                                                                            SHA256

                                                                                                            964386d700918d9d89c2f1c1f8bf562bfbac8f9979e0ad420d3fd2fa9f2f9ce5

                                                                                                            SHA512

                                                                                                            5ff8700cf027804492cfc90d32cd730a4e421743e79df386dec743b26b5652e0453ab1798e0dda5bf6772d9804e4acecb69984e56e522f4a3f49951408afb330

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            aedbadda0ec5c16579979a4f56cae123

                                                                                                            SHA1

                                                                                                            c29931688e4fc1421363eb7cd8acf8c6770ec36d

                                                                                                            SHA256

                                                                                                            964386d700918d9d89c2f1c1f8bf562bfbac8f9979e0ad420d3fd2fa9f2f9ce5

                                                                                                            SHA512

                                                                                                            5ff8700cf027804492cfc90d32cd730a4e421743e79df386dec743b26b5652e0453ab1798e0dda5bf6772d9804e4acecb69984e56e522f4a3f49951408afb330

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6dfdafffb261016fbda6622bc9a07249

                                                                                                            SHA1

                                                                                                            ec8db0b2386a14b3248bdf09aa334b07f8f523eb

                                                                                                            SHA256

                                                                                                            7d68b4d55df130cd7af1fbeb5cb9c6cf8806026c5ee79dc7d85c4492a8714819

                                                                                                            SHA512

                                                                                                            21e606443651bb5289781a1645fa8e34ab4cc508739619e1c2c961fe0685a794bfe19f3b6aaf78fde9c811a90e44955fb1885db0a3a92cf576f3a1297d6809db

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            6dfdafffb261016fbda6622bc9a07249

                                                                                                            SHA1

                                                                                                            ec8db0b2386a14b3248bdf09aa334b07f8f523eb

                                                                                                            SHA256

                                                                                                            7d68b4d55df130cd7af1fbeb5cb9c6cf8806026c5ee79dc7d85c4492a8714819

                                                                                                            SHA512

                                                                                                            21e606443651bb5289781a1645fa8e34ab4cc508739619e1c2c961fe0685a794bfe19f3b6aaf78fde9c811a90e44955fb1885db0a3a92cf576f3a1297d6809db

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            4992f844e0b3f8dd918b71d419c13ff2

                                                                                                            SHA1

                                                                                                            32c232f89e67aac283e7012d3c97992396b4b2dc

                                                                                                            SHA256

                                                                                                            5be94d709d89470f7017c9b70962ca0ceab81f473aba4de745399b64be9d134a

                                                                                                            SHA512

                                                                                                            6586c00ee8780d67d9eaad413234d679de39438bdf085a43482bc616e152b89fd98280aa4345a86d843314383e2df9c56e91c24357e96cdd8eac0833de66d985

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            4992f844e0b3f8dd918b71d419c13ff2

                                                                                                            SHA1

                                                                                                            32c232f89e67aac283e7012d3c97992396b4b2dc

                                                                                                            SHA256

                                                                                                            5be94d709d89470f7017c9b70962ca0ceab81f473aba4de745399b64be9d134a

                                                                                                            SHA512

                                                                                                            6586c00ee8780d67d9eaad413234d679de39438bdf085a43482bc616e152b89fd98280aa4345a86d843314383e2df9c56e91c24357e96cdd8eac0833de66d985

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Google\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            4aeb014425217df831493763e1c689b1

                                                                                                            SHA1

                                                                                                            a45b2c62b186ae8ded2f50985279a26f13d443f4

                                                                                                            SHA256

                                                                                                            bd2592178b7ca534a4ffb8859ff5a7260034c9df0a90f5115c43b4d0642760e7

                                                                                                            SHA512

                                                                                                            5e8ae96c7a90a44df38db33499d8cdd38d0c2c243ce9ac9c327231b3fa705e14715909d3c98cb17ce449c7dcfc46dfdc6175c7105e39cac7f1549d9def3a7c1c

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Google\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            4aeb014425217df831493763e1c689b1

                                                                                                            SHA1

                                                                                                            a45b2c62b186ae8ded2f50985279a26f13d443f4

                                                                                                            SHA256

                                                                                                            bd2592178b7ca534a4ffb8859ff5a7260034c9df0a90f5115c43b4d0642760e7

                                                                                                            SHA512

                                                                                                            5e8ae96c7a90a44df38db33499d8cdd38d0c2c243ce9ac9c327231b3fa705e14715909d3c98cb17ce449c7dcfc46dfdc6175c7105e39cac7f1549d9def3a7c1c

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Internet Explorer\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            446a1a2d4b3c4c046cc20f4f1e0c68b3

                                                                                                            SHA1

                                                                                                            c12c7c3614aabf4711c0556cdd7094e559a296fe

                                                                                                            SHA256

                                                                                                            244236b7669226acbae2c315458113dd20eaffb7f4dba15d8431588e547a6e84

                                                                                                            SHA512

                                                                                                            c8fb220ec19af1fa9984a7a9652b8a6bfb7a374172551cf17f8b07ab7a9bb9c63c5b82a719cb04aa5272eb1b4ffe69b11e62edd51b9c6d8af692cfd203ce87d7

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\Internet Explorer\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            446a1a2d4b3c4c046cc20f4f1e0c68b3

                                                                                                            SHA1

                                                                                                            c12c7c3614aabf4711c0556cdd7094e559a296fe

                                                                                                            SHA256

                                                                                                            244236b7669226acbae2c315458113dd20eaffb7f4dba15d8431588e547a6e84

                                                                                                            SHA512

                                                                                                            c8fb220ec19af1fa9984a7a9652b8a6bfb7a374172551cf17f8b07ab7a9bb9c63c5b82a719cb04aa5272eb1b4ffe69b11e62edd51b9c6d8af692cfd203ce87d7

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            37aecaf15dcaec0ea238b006500b7518

                                                                                                            SHA1

                                                                                                            77e02f5c8d927afe05463546c2de66a8f0b428e4

                                                                                                            SHA256

                                                                                                            fa130d993815f722d69e6adcc72762a51c9391ba4352d875cd7a53cc97e5e325

                                                                                                            SHA512

                                                                                                            a6d6315e4194a5d08c018d5710a17f01786ffc86b430067dec071ce89870f5e3d19a85e03289480aa8ee399a8cdcdec37bdf217e2ce20024cd94583ac73f4bc0

                                                                                                            Download Submit

                                                                                                          • C:\Program Files\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            37aecaf15dcaec0ea238b006500b7518

                                                                                                            SHA1

                                                                                                            77e02f5c8d927afe05463546c2de66a8f0b428e4

                                                                                                            SHA256

                                                                                                            fa130d993815f722d69e6adcc72762a51c9391ba4352d875cd7a53cc97e5e325

                                                                                                            SHA512

                                                                                                            a6d6315e4194a5d08c018d5710a17f01786ffc86b430067dec071ce89870f5e3d19a85e03289480aa8ee399a8cdcdec37bdf217e2ce20024cd94583ac73f4bc0

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3741745895\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3b31c1ff8abbba02e679e2ca680f19b4

                                                                                                            SHA1

                                                                                                            90a0f1f4d6348aee2c7a34a30882f821840e704b

                                                                                                            SHA256

                                                                                                            7fa01e5da67c1926cfacc9452ba671dd644195c4da671269360f4f94cfbc60f7

                                                                                                            SHA512

                                                                                                            f081ae1a3bb3767298e972aec0d11e7f40382ef05109550322a7bba1877e390401c193a981b3b2deed0d1dc4574511fb698692d910e2e365b24b83329ad88e1a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\3741745895\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3b31c1ff8abbba02e679e2ca680f19b4

                                                                                                            SHA1

                                                                                                            90a0f1f4d6348aee2c7a34a30882f821840e704b

                                                                                                            SHA256

                                                                                                            7fa01e5da67c1926cfacc9452ba671dd644195c4da671269360f4f94cfbc60f7

                                                                                                            SHA512

                                                                                                            f081ae1a3bb3767298e972aec0d11e7f40382ef05109550322a7bba1877e390401c193a981b3b2deed0d1dc4574511fb698692d910e2e365b24b83329ad88e1a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a587cfbbf02937f2e9ad2fb033db28d0

                                                                                                            SHA1

                                                                                                            374cb6bd82eb36083f78382b8e3d6b41fa5eddbf

                                                                                                            SHA256

                                                                                                            447f128743e91e7363229b9edf3dde3e8aa13c99ec9cd877a7aaa153409344af

                                                                                                            SHA512

                                                                                                            007ecce90a289777a118821072480359f110b8d3d827156c7985eca33109961ec14bd761a32e0c41028059dc447cc27c9681130aa5b4a91b03f75640c8b77724

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a587cfbbf02937f2e9ad2fb033db28d0

                                                                                                            SHA1

                                                                                                            374cb6bd82eb36083f78382b8e3d6b41fa5eddbf

                                                                                                            SHA256

                                                                                                            447f128743e91e7363229b9edf3dde3e8aa13c99ec9cd877a7aaa153409344af

                                                                                                            SHA512

                                                                                                            007ecce90a289777a118821072480359f110b8d3d827156c7985eca33109961ec14bd761a32e0c41028059dc447cc27c9681130aa5b4a91b03f75640c8b77724

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a587cfbbf02937f2e9ad2fb033db28d0

                                                                                                            SHA1

                                                                                                            374cb6bd82eb36083f78382b8e3d6b41fa5eddbf

                                                                                                            SHA256

                                                                                                            447f128743e91e7363229b9edf3dde3e8aa13c99ec9cd877a7aaa153409344af

                                                                                                            SHA512

                                                                                                            007ecce90a289777a118821072480359f110b8d3d827156c7985eca33109961ec14bd761a32e0c41028059dc447cc27c9681130aa5b4a91b03f75640c8b77724

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a587cfbbf02937f2e9ad2fb033db28d0

                                                                                                            SHA1

                                                                                                            374cb6bd82eb36083f78382b8e3d6b41fa5eddbf

                                                                                                            SHA256

                                                                                                            447f128743e91e7363229b9edf3dde3e8aa13c99ec9cd877a7aaa153409344af

                                                                                                            SHA512

                                                                                                            007ecce90a289777a118821072480359f110b8d3d827156c7985eca33109961ec14bd761a32e0c41028059dc447cc27c9681130aa5b4a91b03f75640c8b77724

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            730930ca11fe40725b1fc424ceccafa5

                                                                                                            SHA1

                                                                                                            cb61d5bfed9c0250648091ff4c69e62c840c5de7

                                                                                                            SHA256

                                                                                                            cb62f32545521638943bb8f7bab7fc9851ba35892120d241d5ecf01fd971a087

                                                                                                            SHA512

                                                                                                            0264154b7ba9c12752c5e991d5e63436662d91bb015bbdf59fb141a07c3e7a2bceb49235e103cfa21a9f9eece626c1325d136566b631d30376add467a20b92c8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            730930ca11fe40725b1fc424ceccafa5

                                                                                                            SHA1

                                                                                                            cb61d5bfed9c0250648091ff4c69e62c840c5de7

                                                                                                            SHA256

                                                                                                            cb62f32545521638943bb8f7bab7fc9851ba35892120d241d5ecf01fd971a087

                                                                                                            SHA512

                                                                                                            0264154b7ba9c12752c5e991d5e63436662d91bb015bbdf59fb141a07c3e7a2bceb49235e103cfa21a9f9eece626c1325d136566b631d30376add467a20b92c8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3b31c1ff8abbba02e679e2ca680f19b4

                                                                                                            SHA1

                                                                                                            90a0f1f4d6348aee2c7a34a30882f821840e704b

                                                                                                            SHA256

                                                                                                            7fa01e5da67c1926cfacc9452ba671dd644195c4da671269360f4f94cfbc60f7

                                                                                                            SHA512

                                                                                                            f081ae1a3bb3767298e972aec0d11e7f40382ef05109550322a7bba1877e390401c193a981b3b2deed0d1dc4574511fb698692d910e2e365b24b83329ad88e1a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3b31c1ff8abbba02e679e2ca680f19b4

                                                                                                            SHA1

                                                                                                            90a0f1f4d6348aee2c7a34a30882f821840e704b

                                                                                                            SHA256

                                                                                                            7fa01e5da67c1926cfacc9452ba671dd644195c4da671269360f4f94cfbc60f7

                                                                                                            SHA512

                                                                                                            f081ae1a3bb3767298e972aec0d11e7f40382ef05109550322a7bba1877e390401c193a981b3b2deed0d1dc4574511fb698692d910e2e365b24b83329ad88e1a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3b31c1ff8abbba02e679e2ca680f19b4

                                                                                                            SHA1

                                                                                                            90a0f1f4d6348aee2c7a34a30882f821840e704b

                                                                                                            SHA256

                                                                                                            7fa01e5da67c1926cfacc9452ba671dd644195c4da671269360f4f94cfbc60f7

                                                                                                            SHA512

                                                                                                            f081ae1a3bb3767298e972aec0d11e7f40382ef05109550322a7bba1877e390401c193a981b3b2deed0d1dc4574511fb698692d910e2e365b24b83329ad88e1a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            3b31c1ff8abbba02e679e2ca680f19b4

                                                                                                            SHA1

                                                                                                            90a0f1f4d6348aee2c7a34a30882f821840e704b

                                                                                                            SHA256

                                                                                                            7fa01e5da67c1926cfacc9452ba671dd644195c4da671269360f4f94cfbc60f7

                                                                                                            SHA512

                                                                                                            f081ae1a3bb3767298e972aec0d11e7f40382ef05109550322a7bba1877e390401c193a981b3b2deed0d1dc4574511fb698692d910e2e365b24b83329ad88e1a

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            730930ca11fe40725b1fc424ceccafa5

                                                                                                            SHA1

                                                                                                            cb61d5bfed9c0250648091ff4c69e62c840c5de7

                                                                                                            SHA256

                                                                                                            cb62f32545521638943bb8f7bab7fc9851ba35892120d241d5ecf01fd971a087

                                                                                                            SHA512

                                                                                                            0264154b7ba9c12752c5e991d5e63436662d91bb015bbdf59fb141a07c3e7a2bceb49235e103cfa21a9f9eece626c1325d136566b631d30376add467a20b92c8

                                                                                                            Download Submit

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            730930ca11fe40725b1fc424ceccafa5

                                                                                                            SHA1

                                                                                                            cb61d5bfed9c0250648091ff4c69e62c840c5de7

                                                                                                            SHA256

                                                                                                            cb62f32545521638943bb8f7bab7fc9851ba35892120d241d5ecf01fd971a087

                                                                                                            SHA512

                                                                                                            0264154b7ba9c12752c5e991d5e63436662d91bb015bbdf59fb141a07c3e7a2bceb49235e103cfa21a9f9eece626c1325d136566b631d30376add467a20b92c8

                                                                                                            Download Submit

                                                                                                          • C:\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            d215a0e87e08cc5c4abb0615a99da86c

                                                                                                            SHA1

                                                                                                            97de0daa322d4f3be26a2d99043e5822d1a66047

                                                                                                            SHA256

                                                                                                            fe45997a87d2728eb2f076b240d6d953f8383c4e786cfdeeaac2bcddc835ce40

                                                                                                            SHA512

                                                                                                            e3bc76c61f5201c96bf4972bc52ad1b9d9f8322ed40f409e10066c76c89044268c1ec7cc17c532860b62d3d1d73004dc9ef43c238412db8fcec0a7225a510c40

                                                                                                            Download Submit

                                                                                                          • C:\backup.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            d215a0e87e08cc5c4abb0615a99da86c

                                                                                                            SHA1

                                                                                                            97de0daa322d4f3be26a2d99043e5822d1a66047

                                                                                                            SHA256

                                                                                                            fe45997a87d2728eb2f076b240d6d953f8383c4e786cfdeeaac2bcddc835ce40

                                                                                                            SHA512

                                                                                                            e3bc76c61f5201c96bf4972bc52ad1b9d9f8322ed40f409e10066c76c89044268c1ec7cc17c532860b62d3d1d73004dc9ef43c238412db8fcec0a7225a510c40

                                                                                                            Download Submit

                                                                                                          • C:\odt\System Restore.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            10ec4ca61beec61a00137eb610d05e55

                                                                                                            SHA1

                                                                                                            4bffbbe569115d37e4ecbd7895123bdae2d3d33b

                                                                                                            SHA256

                                                                                                            b0880f645921910f21a536494370917af7eb53b68cf207ab746fb53a56316643

                                                                                                            SHA512

                                                                                                            0bda31422baf5d82d1c60552adaa0a839615521f61967f8861c0d21994c923c7eba2ecc6d97c6af473a398219d37216364aad722c931b9008955c249ed11cb92

                                                                                                            Download Submit

                                                                                                          • C:\odt\System Restore.exe
                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            10ec4ca61beec61a00137eb610d05e55

                                                                                                            SHA1

                                                                                                            4bffbbe569115d37e4ecbd7895123bdae2d3d33b

                                                                                                            SHA256

                                                                                                            b0880f645921910f21a536494370917af7eb53b68cf207ab746fb53a56316643

                                                                                                            SHA512

                                                                                                            0bda31422baf5d82d1c60552adaa0a839615521f61967f8861c0d21994c923c7eba2ecc6d97c6af473a398219d37216364aad722c931b9008955c249ed11cb92

                                                                                                            Download Submit