Overview

overview

10

Static

static

152e0e2096...f8.exe

windows7-x64

10

152e0e2096...f8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    187s
  • max time network
    214s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 20:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    152e0e20969f13b7341bf2c5f4eaeabc43a5e9fc771ab0e4799c41924fb07ff8.exe

  • Size

    72KB

  • MD5

    ed09aeffb98b68502af51e8cd3a4e178

  • SHA1

    d4c015069faf5ee2413a78c266c7a75d79c97fff

  • SHA256

    152e0e20969f13b7341bf2c5f4eaeabc43a5e9fc771ab0e4799c41924fb07ff8

  • SHA512

    bc45a3c62e561c565bd70c8694b8c2fb7bfba622556762a36423d9264740af3c8cea906356b1b0948ab3377de5d0edfc7215d075381b5630072d347823f78b8b

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2h:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrN

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 32 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\152e0e20969f13b7341bf2c5f4eaeabc43a5e9fc771ab0e4799c41924fb07ff8.exe
    "C:\Users\Admin\AppData\Local\Temp\152e0e20969f13b7341bf2c5f4eaeabc43a5e9fc771ab0e4799c41924fb07ff8.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\1742477204\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1742477204\backup.exe C:\Users\Admin\AppData\Local\Temp\1742477204\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2856
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3544
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4532
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:484
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:5052
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:428
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3252
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1660
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1928
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3108
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:3316
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:1268
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5116
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4672
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4056
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1348
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1240
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3084
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2628
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1416
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4468
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\update.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3356
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4228
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1272
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:2460
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:3532
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Drops file in Program Files directory
                  PID:4000
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    PID:364
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Disables RegEdit via registry modification
                    PID:3084
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:3792
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\data.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                    9⤵
                      PID:852
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                        PID:2044
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                        9⤵
                          PID:3792
                      • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                        8⤵
                          PID:3676
                        • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                          8⤵
                          • System policy modification
                          PID:3336
                        • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                          8⤵
                          • Disables RegEdit via registry modification
                          PID:3624
                        • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          PID:4004
                        • C:\Program Files\Common Files\microsoft shared\ink\it-IT\update.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\it-IT\update.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                          8⤵
                            PID:2756
                          • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\data.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:4188
                          • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:4308
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                          7⤵
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:4656
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                            8⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:4360
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\update.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                            8⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:216
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                            8⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:632
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:548
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                            8⤵
                            • Disables RegEdit via registry modification
                            PID:3336
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                            8⤵
                              PID:1344
                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                            7⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:5048
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4268
                          • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                            7⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:4960
                          • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                            7⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:3776
                          • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:2176
                          • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                            7⤵
                              PID:2572
                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                8⤵
                                  PID:2316
                              • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • System policy modification
                                PID:3396
                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:2100
                              • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                7⤵
                                • Disables RegEdit via registry modification
                                PID:3788
                              • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                7⤵
                                  PID:3100
                                • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                  7⤵
                                    PID:1564
                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Drops file in Program Files directory
                                      PID:4296
                                      • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                        9⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        PID:4692
                                • C:\Program Files\Common Files\Services\backup.exe
                                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                  6⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:4336
                                • C:\Program Files\Common Files\System\backup.exe
                                  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                  6⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:5112
                                  • C:\Program Files\Common Files\System\ado\backup.exe
                                    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:4668
                                    • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4424
                                    • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                      8⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:208
                                    • C:\Program Files\Common Files\System\ado\es-ES\update.exe
                                      "C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System policy modification
                                      PID:3084
                                    • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      PID:4864
                                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                      8⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:1872
                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                      8⤵
                                        PID:4812
                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:3264
                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                      7⤵
                                        PID:4628
                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1908
                                      • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:3324
                                      • C:\Program Files\Common Files\System\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System policy modification
                                        PID:1548
                                      • C:\Program Files\Common Files\System\ja-JP\update.exe
                                        "C:\Program Files\Common Files\System\ja-JP\update.exe" C:\Program Files\Common Files\System\ja-JP\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:1516
                                      • C:\Program Files\Common Files\System\msadc\backup.exe
                                        "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                        7⤵
                                          PID:4212
                                    • C:\Program Files\Google\backup.exe
                                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                      5⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:920
                                      • C:\Program Files\Google\Chrome\backup.exe
                                        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3032
                                        • C:\Program Files\Google\Chrome\Application\backup.exe
                                          "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1012
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                            8⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2408
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4780
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • System policy modification
                                              PID:1936
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                              9⤵
                                                PID:4524
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                9⤵
                                                • Disables RegEdit via registry modification
                                                PID:3524
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                9⤵
                                                • Disables RegEdit via registry modification
                                                PID:4540
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                9⤵
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:3972
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                9⤵
                                                • System policy modification
                                                PID:208
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                9⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                PID:1820
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                  10⤵
                                                    PID:396
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                      11⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:4736
                                              • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                PID:1452
                                        • C:\Program Files\Internet Explorer\backup.exe
                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                          5⤵
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1964
                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                            6⤵
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1020
                                          • C:\Program Files\Internet Explorer\en-US\backup.exe
                                            "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1628
                                          • C:\Program Files\Internet Explorer\es-ES\System Restore.exe
                                            "C:\Program Files\Internet Explorer\es-ES\System Restore.exe" C:\Program Files\Internet Explorer\es-ES\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3700
                                          • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                            "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:1732
                                          • C:\Program Files\Internet Explorer\images\backup.exe
                                            "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:4752
                                          • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                            "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • System policy modification
                                            PID:3460
                                          • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                            "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:1316
                                          • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                            "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:4044
                                        • C:\Program Files\Java\backup.exe
                                          "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                          5⤵
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          • System policy modification
                                          PID:1664
                                          • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                            "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Program Files directory
                                            PID:824
                                            • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                              "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                              7⤵
                                              • Disables RegEdit via registry modification
                                              PID:1072
                                            • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                              "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Drops file in Program Files directory
                                              PID:1344
                                              • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:3204
                                              • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                8⤵
                                                • System policy modification
                                                PID:4392
                                            • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                              "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Drops file in Program Files directory
                                              PID:1848
                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                8⤵
                                                  PID:2472
                                              • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                7⤵
                                                  PID:3424
                                              • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:4780
                                                • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                  "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                  7⤵
                                                    PID:5000
                                              • C:\Program Files\Microsoft Office\backup.exe
                                                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                5⤵
                                                  PID:4704
                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                    6⤵
                                                      PID:2928
                                                    • C:\Program Files\Microsoft Office\PackageManifests\System Restore.exe
                                                      "C:\Program Files\Microsoft Office\PackageManifests\System Restore.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • System policy modification
                                                      PID:3056
                                                    • C:\Program Files\Microsoft Office\root\backup.exe
                                                      "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Drops file in Program Files directory
                                                      • System policy modification
                                                      PID:4952
                                                      • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                        "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • System policy modification
                                                        PID:5044
                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                        7⤵
                                                        • Drops file in Program Files directory
                                                        PID:3168
                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                          8⤵
                                                            PID:2056
                                                        • C:\Program Files\Microsoft Office\root\fre\update.exe
                                                          "C:\Program Files\Microsoft Office\root\fre\update.exe" C:\Program Files\Microsoft Office\root\fre\
                                                          7⤵
                                                            PID:1904
                                                        • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                          "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                          6⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • System policy modification
                                                          PID:2148
                                                          • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                            "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                            7⤵
                                                              PID:2408
                                                        • C:\Program Files\Microsoft Office 15\update.exe
                                                          "C:\Program Files\Microsoft Office 15\update.exe" C:\Program Files\Microsoft Office 15\
                                                          5⤵
                                                          • Drops file in Program Files directory
                                                          • System policy modification
                                                          PID:444
                                                          • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                            "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                            6⤵
                                                              PID:2224
                                                          • C:\Program Files\Mozilla Firefox\System Restore.exe
                                                            "C:\Program Files\Mozilla Firefox\System Restore.exe" C:\Program Files\Mozilla Firefox\
                                                            5⤵
                                                              PID:4732
                                                          • C:\Program Files (x86)\backup.exe
                                                            "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                            4⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1828
                                                            • C:\Program Files (x86)\Adobe\backup.exe
                                                              "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                              5⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:5020
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:3600
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                  7⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • System policy modification
                                                                  PID:484
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                  7⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3252
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                    8⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:5116
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                      9⤵
                                                                        PID:1180
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                      8⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      PID:4600
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                        9⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        PID:4840
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                      8⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      PID:1968
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                      8⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:2520
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                      8⤵
                                                                      • System policy modification
                                                                      PID:3120
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                        9⤵
                                                                          PID:1960
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                        8⤵
                                                                        • System policy modification
                                                                        PID:4964
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                          9⤵
                                                                          • System policy modification
                                                                          PID:796
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                        8⤵
                                                                          PID:4768
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                          8⤵
                                                                            PID:4736
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                            8⤵
                                                                              PID:1592
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                            7⤵
                                                                            • System policy modification
                                                                            PID:1020
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                              8⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:440
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                9⤵
                                                                                  PID:5104
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                8⤵
                                                                                  PID:3900
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                  8⤵
                                                                                  • Drops file in Program Files directory
                                                                                  PID:2312
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                    9⤵
                                                                                      PID:4812
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                        10⤵
                                                                                          PID:2712
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:4584
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                      8⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • System policy modification
                                                                                      PID:4984
                                                                              • C:\Program Files (x86)\Common Files\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                5⤵
                                                                                • Drops file in Program Files directory
                                                                                • System policy modification
                                                                                PID:5048
                                                                                • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                  "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                  6⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Program Files directory
                                                                                  PID:556
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                    7⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:3140
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\System Restore.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                    7⤵
                                                                                    • System policy modification
                                                                                    PID:3856
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                      8⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:1188
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                    7⤵
                                                                                    • System policy modification
                                                                                    PID:1436
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                      8⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:3396
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                    7⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:5088
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                      8⤵
                                                                                        PID:4944
                                                                                  • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Drops file in Program Files directory
                                                                                    PID:4792
                                                                                    • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                      7⤵
                                                                                        PID:1764
                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                      6⤵
                                                                                        PID:1820
                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                      5⤵
                                                                                      • Drops file in Program Files directory
                                                                                      PID:3000
                                                                                      • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                        "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                        6⤵
                                                                                          PID:4824
                                                                                        • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                          "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                          6⤵
                                                                                            PID:2012
                                                                                          • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                            "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                            6⤵
                                                                                            • System policy modification
                                                                                            PID:3424
                                                                                          • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                            "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                            6⤵
                                                                                              PID:4008
                                                                                              • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                7⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:3608
                                                                                              • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                7⤵
                                                                                                  PID:5100
                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                              5⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Drops file in Program Files directory
                                                                                              • System policy modification
                                                                                              PID:1884
                                                                                              • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                6⤵
                                                                                                  PID:3120
                                                                                              • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                5⤵
                                                                                                  PID:4692
                                                                                              • C:\Users\backup.exe
                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                4⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:3968
                                                                                                • C:\Users\Admin\backup.exe
                                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                  5⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:2608
                                                                                                  • C:\Users\Admin\3D Objects\backup.exe
                                                                                                    "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:640
                                                                                                  • C:\Users\Admin\Contacts\System Restore.exe
                                                                                                    "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:1308
                                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                    6⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4044
                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                    6⤵
                                                                                                      PID:3420
                                                                                                    • C:\Users\Admin\Downloads\backup.exe
                                                                                                      C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                      6⤵
                                                                                                        PID:1532
                                                                                                      • C:\Users\Admin\Favorites\backup.exe
                                                                                                        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                        6⤵
                                                                                                          PID:560
                                                                                                        • C:\Users\Admin\Links\backup.exe
                                                                                                          C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                          6⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          PID:852
                                                                                                        • C:\Users\Admin\Music\backup.exe
                                                                                                          C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          PID:796
                                                                                                        • C:\Users\Admin\OneDrive\backup.exe
                                                                                                          C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                          6⤵
                                                                                                            PID:3128
                                                                                                          • C:\Users\Admin\Pictures\backup.exe
                                                                                                            C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                            6⤵
                                                                                                              PID:1520
                                                                                                              • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                7⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:2324
                                                                                                              • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                7⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:364
                                                                                                            • C:\Users\Admin\Saved Games\backup.exe
                                                                                                              "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                              6⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:3676
                                                                                                            • C:\Users\Admin\Searches\backup.exe
                                                                                                              C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                              6⤵
                                                                                                                PID:1364
                                                                                                              • C:\Users\Admin\Videos\data.exe
                                                                                                                C:\Users\Admin\Videos\data.exe C:\Users\Admin\Videos\
                                                                                                                6⤵
                                                                                                                  PID:2820
                                                                                                              • C:\Users\Public\backup.exe
                                                                                                                C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                5⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • System policy modification
                                                                                                                PID:4516
                                                                                                                • C:\Users\Public\Documents\System Restore.exe
                                                                                                                  "C:\Users\Public\Documents\System Restore.exe" C:\Users\Public\Documents\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  PID:2232
                                                                                                                • C:\Users\Public\Downloads\backup.exe
                                                                                                                  C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                  6⤵
                                                                                                                    PID:4328
                                                                                                                  • C:\Users\Public\Music\backup.exe
                                                                                                                    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                    6⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:3648
                                                                                                                  • C:\Users\Public\Pictures\backup.exe
                                                                                                                    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                    6⤵
                                                                                                                      PID:5096
                                                                                                                    • C:\Users\Public\Videos\backup.exe
                                                                                                                      C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                      6⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      PID:1564
                                                                                                                • C:\Windows\backup.exe
                                                                                                                  C:\Windows\backup.exe C:\Windows\
                                                                                                                  4⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:652
                                                                                                                  • C:\Windows\addins\backup.exe
                                                                                                                    C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                    5⤵
                                                                                                                      PID:1820
                                                                                                                    • C:\Windows\appcompat\backup.exe
                                                                                                                      C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                      5⤵
                                                                                                                      • Drops file in Windows directory
                                                                                                                      PID:1916
                                                                                                                      • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                        C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                        6⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:4648
                                                                                                                        • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                          C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                          7⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:2812
                                                                                                                      • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                        C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                        6⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:4468
                                                                                                                      • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                        C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                        6⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • System policy modification
                                                                                                                        PID:3592
                                                                                                                    • C:\Windows\apppatch\backup.exe
                                                                                                                      C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                      5⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Drops file in Windows directory
                                                                                                                      • System policy modification
                                                                                                                      PID:3764
                                                                                                                      • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                        C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                        6⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        PID:1592
                                                                                                                      • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                        C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                        6⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:3008
                                                                                                                        • C:\Windows\apppatch\Custom\Custom64\System Restore.exe
                                                                                                                          "C:\Windows\apppatch\Custom\Custom64\System Restore.exe" C:\Windows\apppatch\Custom\Custom64\
                                                                                                                          7⤵
                                                                                                                            PID:700
                                                                                                                        • C:\Windows\apppatch\CustomSDB\backup.exe
                                                                                                                          C:\Windows\apppatch\CustomSDB\backup.exe C:\Windows\apppatch\CustomSDB\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:1708
                                                                                                                        • C:\Windows\apppatch\de-DE\backup.exe
                                                                                                                          C:\Windows\apppatch\de-DE\backup.exe C:\Windows\apppatch\de-DE\
                                                                                                                          6⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          PID:888
                                                                                                                        • C:\Windows\apppatch\en-US\backup.exe
                                                                                                                          C:\Windows\apppatch\en-US\backup.exe C:\Windows\apppatch\en-US\
                                                                                                                          6⤵
                                                                                                                            PID:3436
                                                                                                                          • C:\Windows\apppatch\es-ES\backup.exe
                                                                                                                            C:\Windows\apppatch\es-ES\backup.exe C:\Windows\apppatch\es-ES\
                                                                                                                            6⤵
                                                                                                                              PID:1188
                                                                                                                          • C:\Windows\AppReadiness\backup.exe
                                                                                                                            C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                            5⤵
                                                                                                                              PID:1240
                                                                                                                            • C:\Windows\assembly\backup.exe
                                                                                                                              C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                              5⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:1120
                                                                                                                              • C:\Windows\assembly\GAC\backup.exe
                                                                                                                                C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                                                                6⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5092
                                                                                                                                • C:\Windows\assembly\GAC\ADODB\update.exe
                                                                                                                                  C:\Windows\assembly\GAC\ADODB\update.exe C:\Windows\assembly\GAC\ADODB\
                                                                                                                                  7⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:3492
                                                                                                                                  • C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\update.exe
                                                                                                                                    C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\update.exe C:\Windows\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                    8⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:1452
                                                                                                                                • C:\Windows\assembly\GAC\Extensibility\backup.exe
                                                                                                                                  C:\Windows\assembly\GAC\Extensibility\backup.exe C:\Windows\assembly\GAC\Extensibility\
                                                                                                                                  7⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:4628
                                                                                                                                  • C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe
                                                                                                                                    C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\backup.exe C:\Windows\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\
                                                                                                                                    8⤵
                                                                                                                                      PID:2828
                                                                                                                                  • C:\Windows\assembly\GAC\Microsoft.mshtml\update.exe
                                                                                                                                    C:\Windows\assembly\GAC\Microsoft.mshtml\update.exe C:\Windows\assembly\GAC\Microsoft.mshtml\
                                                                                                                                    7⤵
                                                                                                                                      PID:3900
                                                                                                                                  • C:\Windows\assembly\GAC_32\update.exe
                                                                                                                                    C:\Windows\assembly\GAC_32\update.exe C:\Windows\assembly\GAC_32\
                                                                                                                                    6⤵
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    PID:548
                                                                                                                                    • C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe
                                                                                                                                      C:\Windows\assembly\GAC_32\CustomMarshalers\backup.exe C:\Windows\assembly\GAC_32\CustomMarshalers\
                                                                                                                                      7⤵
                                                                                                                                        PID:2868
                                                                                                                                    • C:\Windows\assembly\GAC_64\backup.exe
                                                                                                                                      C:\Windows\assembly\GAC_64\backup.exe C:\Windows\assembly\GAC_64\
                                                                                                                                      6⤵
                                                                                                                                        PID:2588
                                                                                                                                    • C:\Windows\bcastdvr\backup.exe
                                                                                                                                      C:\Windows\bcastdvr\backup.exe C:\Windows\bcastdvr\
                                                                                                                                      5⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:1012
                                                                                                                                    • C:\Windows\Branding\backup.exe
                                                                                                                                      C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                                                      5⤵
                                                                                                                                        PID:3428
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:116
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  • System policy modification
                                                                                                                                  PID:4268
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:1060
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                  2⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  • System policy modification
                                                                                                                                  PID:876
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                  2⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:1488
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                  2⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                  PID:4228

                                                                                                                              Network

                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                              Replay Monitor

                                                                                                                              Loading Replay Monitor...

                                                                                                                              Downloads

                                                                                                                              • C:\PerfLogs\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                2341ea55e0e8729c605beff4550da7ec

                                                                                                                                SHA1

                                                                                                                                03280097aed84384216d517e3ca46ad871e9374f

                                                                                                                                SHA256

                                                                                                                                b0415445ca27b685ab343303da865274dd91c8b0b4a8e545d22a9ed9d900c842

                                                                                                                                SHA512

                                                                                                                                df912aeb7d56f38a2d8ea0248b605f686331e1e6ddd3823e140d578b43cfc822edb3b00be0df42069a66993813c5978988a4f08d263c938d9bc33e91ccd76603

                                                                                                                                Download Submit

                                                                                                                              • C:\PerfLogs\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                2341ea55e0e8729c605beff4550da7ec

                                                                                                                                SHA1

                                                                                                                                03280097aed84384216d517e3ca46ad871e9374f

                                                                                                                                SHA256

                                                                                                                                b0415445ca27b685ab343303da865274dd91c8b0b4a8e545d22a9ed9d900c842

                                                                                                                                SHA512

                                                                                                                                df912aeb7d56f38a2d8ea0248b605f686331e1e6ddd3823e140d578b43cfc822edb3b00be0df42069a66993813c5978988a4f08d263c938d9bc33e91ccd76603

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files (x86)\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                8e8cc11d80a008ab394d27466fc0f752

                                                                                                                                SHA1

                                                                                                                                f2c10766a5bdb87ea1edc580a0f0f9e4562687c3

                                                                                                                                SHA256

                                                                                                                                3d1f8e24a723223f0e22382c2f630a84a0a6d9a450293aedce1b97e1d6cd1dd7

                                                                                                                                SHA512

                                                                                                                                13c166d78f98a2b22a61775db8da01b2841b73df5219b2a4a25433aac31243c6aae387c4af887a92797098afe4d9d4e0ca299581adc7be9cd94104e41df119a9

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files (x86)\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                8e8cc11d80a008ab394d27466fc0f752

                                                                                                                                SHA1

                                                                                                                                f2c10766a5bdb87ea1edc580a0f0f9e4562687c3

                                                                                                                                SHA256

                                                                                                                                3d1f8e24a723223f0e22382c2f630a84a0a6d9a450293aedce1b97e1d6cd1dd7

                                                                                                                                SHA512

                                                                                                                                13c166d78f98a2b22a61775db8da01b2841b73df5219b2a4a25433aac31243c6aae387c4af887a92797098afe4d9d4e0ca299581adc7be9cd94104e41df119a9

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                485e9671f21933aa51edceeaf8baad46

                                                                                                                                SHA1

                                                                                                                                7f72c7de28350f21b46e7dde304fa92ac338544b

                                                                                                                                SHA256

                                                                                                                                da6ee1cbee8cb6425ec664f4731e7b5b0ecb8374437e6ab6a76002becd99bb08

                                                                                                                                SHA512

                                                                                                                                b856796fe2039ac1cd9c5ea71b416be0dd809336243564210c45a6f1ca3d251a0addbbb1f6dcebfe5c036fdcdf856fa41c995bf83f1d79303fab86a6b5b3a18b

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                485e9671f21933aa51edceeaf8baad46

                                                                                                                                SHA1

                                                                                                                                7f72c7de28350f21b46e7dde304fa92ac338544b

                                                                                                                                SHA256

                                                                                                                                da6ee1cbee8cb6425ec664f4731e7b5b0ecb8374437e6ab6a76002becd99bb08

                                                                                                                                SHA512

                                                                                                                                b856796fe2039ac1cd9c5ea71b416be0dd809336243564210c45a6f1ca3d251a0addbbb1f6dcebfe5c036fdcdf856fa41c995bf83f1d79303fab86a6b5b3a18b

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\7-Zip\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                f536d1ceb424581b2acfe2b4aee7a195

                                                                                                                                SHA1

                                                                                                                                d3469a67fe12ddbac7bb504794505fc8171aa0de

                                                                                                                                SHA256

                                                                                                                                0ba6e79ec4099caae1f68810f3f6f75fe4f678c5c1288b1590d173d2b7880485

                                                                                                                                SHA512

                                                                                                                                e7541fb24a58a8d61bed544d32726da58b41bc9984b0d0e5c147cc95f5f9cda8928ee9cbdfd5dac039cef947f0c4349cb499683cb2e308d00bff25ea2c36a5df

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\7-Zip\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                f536d1ceb424581b2acfe2b4aee7a195

                                                                                                                                SHA1

                                                                                                                                d3469a67fe12ddbac7bb504794505fc8171aa0de

                                                                                                                                SHA256

                                                                                                                                0ba6e79ec4099caae1f68810f3f6f75fe4f678c5c1288b1590d173d2b7880485

                                                                                                                                SHA512

                                                                                                                                e7541fb24a58a8d61bed544d32726da58b41bc9984b0d0e5c147cc95f5f9cda8928ee9cbdfd5dac039cef947f0c4349cb499683cb2e308d00bff25ea2c36a5df

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                68e77758658cf8e8a76e3c993d4da6a1

                                                                                                                                SHA1

                                                                                                                                43786ebca510bcd451bd1a22f2bcf243d3d18155

                                                                                                                                SHA256

                                                                                                                                e37f24c79ec2bbc99250939e8915a2a8311328b13070449046924c24dc10e634

                                                                                                                                SHA512

                                                                                                                                5aab826e9d1a1dcbdaac3d1cd2593b82810f1e9ea35745c7e35cd77ee9d10a02ae730801d7d41d971c110f4492bfa46ff4f35fc950508faf9c5470c652e95e83

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                68e77758658cf8e8a76e3c993d4da6a1

                                                                                                                                SHA1

                                                                                                                                43786ebca510bcd451bd1a22f2bcf243d3d18155

                                                                                                                                SHA256

                                                                                                                                e37f24c79ec2bbc99250939e8915a2a8311328b13070449046924c24dc10e634

                                                                                                                                SHA512

                                                                                                                                5aab826e9d1a1dcbdaac3d1cd2593b82810f1e9ea35745c7e35cd77ee9d10a02ae730801d7d41d971c110f4492bfa46ff4f35fc950508faf9c5470c652e95e83

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\Services\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                c87f8e0a13fd91133730ae6fe1e2f081

                                                                                                                                SHA1

                                                                                                                                282078d94ea2b238b10d19458926a06c6c236fd4

                                                                                                                                SHA256

                                                                                                                                00f4c09528764e76521ffa8bd713628f91fac01aa6fb3f6bda7516809ffaf899

                                                                                                                                SHA512

                                                                                                                                1a335abba8de65484f630d5f5af2e8b59e438e594483dffca6f1862d9e01d4ff3546b13f60cfa370d85ff73399ed4b9dc99eb63456cb7db0cb4518760e59c47d

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\Services\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                c87f8e0a13fd91133730ae6fe1e2f081

                                                                                                                                SHA1

                                                                                                                                282078d94ea2b238b10d19458926a06c6c236fd4

                                                                                                                                SHA256

                                                                                                                                00f4c09528764e76521ffa8bd713628f91fac01aa6fb3f6bda7516809ffaf899

                                                                                                                                SHA512

                                                                                                                                1a335abba8de65484f630d5f5af2e8b59e438e594483dffca6f1862d9e01d4ff3546b13f60cfa370d85ff73399ed4b9dc99eb63456cb7db0cb4518760e59c47d

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                f536d1ceb424581b2acfe2b4aee7a195

                                                                                                                                SHA1

                                                                                                                                d3469a67fe12ddbac7bb504794505fc8171aa0de

                                                                                                                                SHA256

                                                                                                                                0ba6e79ec4099caae1f68810f3f6f75fe4f678c5c1288b1590d173d2b7880485

                                                                                                                                SHA512

                                                                                                                                e7541fb24a58a8d61bed544d32726da58b41bc9984b0d0e5c147cc95f5f9cda8928ee9cbdfd5dac039cef947f0c4349cb499683cb2e308d00bff25ea2c36a5df

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                f536d1ceb424581b2acfe2b4aee7a195

                                                                                                                                SHA1

                                                                                                                                d3469a67fe12ddbac7bb504794505fc8171aa0de

                                                                                                                                SHA256

                                                                                                                                0ba6e79ec4099caae1f68810f3f6f75fe4f678c5c1288b1590d173d2b7880485

                                                                                                                                SHA512

                                                                                                                                e7541fb24a58a8d61bed544d32726da58b41bc9984b0d0e5c147cc95f5f9cda8928ee9cbdfd5dac039cef947f0c4349cb499683cb2e308d00bff25ea2c36a5df

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                d463adb6fbdaebf53e726033e7201e12

                                                                                                                                SHA1

                                                                                                                                20d666b64aa9e58b8456067a0c67811f0235b6e7

                                                                                                                                SHA256

                                                                                                                                31b85e62d0982b74f1cf347f1af6abd935ff4264f91edf3778335f9332d4d364

                                                                                                                                SHA512

                                                                                                                                0cf048b7633ee9446e713d0d8792e9bc984248b247b1c343850cc454844457c0bb11fa27b06899952d25845c09644c053383b43a52e4b75107dd54c806cdafa2

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                d463adb6fbdaebf53e726033e7201e12

                                                                                                                                SHA1

                                                                                                                                20d666b64aa9e58b8456067a0c67811f0235b6e7

                                                                                                                                SHA256

                                                                                                                                31b85e62d0982b74f1cf347f1af6abd935ff4264f91edf3778335f9332d4d364

                                                                                                                                SHA512

                                                                                                                                0cf048b7633ee9446e713d0d8792e9bc984248b247b1c343850cc454844457c0bb11fa27b06899952d25845c09644c053383b43a52e4b75107dd54c806cdafa2

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                c56dcdf9e59e30cd9c38d958812c9aae

                                                                                                                                SHA1

                                                                                                                                2f095ce4a6c95c73759262e9120bf3419a971722

                                                                                                                                SHA256

                                                                                                                                8382f993e486ab0662bd5fe082cb13fc34db7866db37d5160ff233ee07ca3780

                                                                                                                                SHA512

                                                                                                                                d2df1f088347ceb4dc668b5e50bb64f67b7bbb5962f124f94956393176ec2ff329228c6bc02d4397d3a72eba3163404e400d2893cd7dca4e630f29af180abb2c

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                c56dcdf9e59e30cd9c38d958812c9aae

                                                                                                                                SHA1

                                                                                                                                2f095ce4a6c95c73759262e9120bf3419a971722

                                                                                                                                SHA256

                                                                                                                                8382f993e486ab0662bd5fe082cb13fc34db7866db37d5160ff233ee07ca3780

                                                                                                                                SHA512

                                                                                                                                d2df1f088347ceb4dc668b5e50bb64f67b7bbb5962f124f94956393176ec2ff329228c6bc02d4397d3a72eba3163404e400d2893cd7dca4e630f29af180abb2c

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                09de7f9790fd8c350d761e0c5367fa34

                                                                                                                                SHA1

                                                                                                                                d57f5b740aa233d5dd1d439ca059bbadeb14136b

                                                                                                                                SHA256

                                                                                                                                5c2bfe00242484eba4f02697896db2adc61f7d98ca668514deb4a280066ce211

                                                                                                                                SHA512

                                                                                                                                5abdf7d88c05645f38df17e56e703e5fbb3c87925b76abd79081c225566e2691e53631eb8fdc29397fabcd7c056be8713e2b25a538c9843170bcb2e2e7751a20

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                09de7f9790fd8c350d761e0c5367fa34

                                                                                                                                SHA1

                                                                                                                                d57f5b740aa233d5dd1d439ca059bbadeb14136b

                                                                                                                                SHA256

                                                                                                                                5c2bfe00242484eba4f02697896db2adc61f7d98ca668514deb4a280066ce211

                                                                                                                                SHA512

                                                                                                                                5abdf7d88c05645f38df17e56e703e5fbb3c87925b76abd79081c225566e2691e53631eb8fdc29397fabcd7c056be8713e2b25a538c9843170bcb2e2e7751a20

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                68e77758658cf8e8a76e3c993d4da6a1

                                                                                                                                SHA1

                                                                                                                                43786ebca510bcd451bd1a22f2bcf243d3d18155

                                                                                                                                SHA256

                                                                                                                                e37f24c79ec2bbc99250939e8915a2a8311328b13070449046924c24dc10e634

                                                                                                                                SHA512

                                                                                                                                5aab826e9d1a1dcbdaac3d1cd2593b82810f1e9ea35745c7e35cd77ee9d10a02ae730801d7d41d971c110f4492bfa46ff4f35fc950508faf9c5470c652e95e83

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                68e77758658cf8e8a76e3c993d4da6a1

                                                                                                                                SHA1

                                                                                                                                43786ebca510bcd451bd1a22f2bcf243d3d18155

                                                                                                                                SHA256

                                                                                                                                e37f24c79ec2bbc99250939e8915a2a8311328b13070449046924c24dc10e634

                                                                                                                                SHA512

                                                                                                                                5aab826e9d1a1dcbdaac3d1cd2593b82810f1e9ea35745c7e35cd77ee9d10a02ae730801d7d41d971c110f4492bfa46ff4f35fc950508faf9c5470c652e95e83

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                d463adb6fbdaebf53e726033e7201e12

                                                                                                                                SHA1

                                                                                                                                20d666b64aa9e58b8456067a0c67811f0235b6e7

                                                                                                                                SHA256

                                                                                                                                31b85e62d0982b74f1cf347f1af6abd935ff4264f91edf3778335f9332d4d364

                                                                                                                                SHA512

                                                                                                                                0cf048b7633ee9446e713d0d8792e9bc984248b247b1c343850cc454844457c0bb11fa27b06899952d25845c09644c053383b43a52e4b75107dd54c806cdafa2

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                d463adb6fbdaebf53e726033e7201e12

                                                                                                                                SHA1

                                                                                                                                20d666b64aa9e58b8456067a0c67811f0235b6e7

                                                                                                                                SHA256

                                                                                                                                31b85e62d0982b74f1cf347f1af6abd935ff4264f91edf3778335f9332d4d364

                                                                                                                                SHA512

                                                                                                                                0cf048b7633ee9446e713d0d8792e9bc984248b247b1c343850cc454844457c0bb11fa27b06899952d25845c09644c053383b43a52e4b75107dd54c806cdafa2

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\de-DE\System Restore.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                70784b30f09f12166809a8528dbeecc5

                                                                                                                                SHA1

                                                                                                                                c77e5b3b73f98c61b2b511f0495624758a700802

                                                                                                                                SHA256

                                                                                                                                7d94ae8538f4bab8b020e89c4131435ea850cc28c1ca2270e27c755717bc1fb6

                                                                                                                                SHA512

                                                                                                                                034d00167c8f924bf3850a36cc5268cdf186c19160e9ef286e46ba6987c9f88aaa35c2cb8656604a3e524fb140c2dbf388bcc978150fb666e88c715059181450

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                534a5de7cb32edde006ec45718ba2722

                                                                                                                                SHA1

                                                                                                                                7d67844de641ad278ef4c52f6bef1118ffceda3a

                                                                                                                                SHA256

                                                                                                                                54c99d5642ff938d295a711dee01ea4ec5509e110468d312fcefef50b4d75454

                                                                                                                                SHA512

                                                                                                                                cffe2a37f9634f119b3457c2ea484e93872b44da70ffacd85b218dd126b8161f26fcf7ce3bdd97248e1af05911301ed1816ab3bfc0d6e8bca7fac0e49bdb4c16

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                534a5de7cb32edde006ec45718ba2722

                                                                                                                                SHA1

                                                                                                                                7d67844de641ad278ef4c52f6bef1118ffceda3a

                                                                                                                                SHA256

                                                                                                                                54c99d5642ff938d295a711dee01ea4ec5509e110468d312fcefef50b4d75454

                                                                                                                                SHA512

                                                                                                                                cffe2a37f9634f119b3457c2ea484e93872b44da70ffacd85b218dd126b8161f26fcf7ce3bdd97248e1af05911301ed1816ab3bfc0d6e8bca7fac0e49bdb4c16

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                534a5de7cb32edde006ec45718ba2722

                                                                                                                                SHA1

                                                                                                                                7d67844de641ad278ef4c52f6bef1118ffceda3a

                                                                                                                                SHA256

                                                                                                                                54c99d5642ff938d295a711dee01ea4ec5509e110468d312fcefef50b4d75454

                                                                                                                                SHA512

                                                                                                                                cffe2a37f9634f119b3457c2ea484e93872b44da70ffacd85b218dd126b8161f26fcf7ce3bdd97248e1af05911301ed1816ab3bfc0d6e8bca7fac0e49bdb4c16

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                534a5de7cb32edde006ec45718ba2722

                                                                                                                                SHA1

                                                                                                                                7d67844de641ad278ef4c52f6bef1118ffceda3a

                                                                                                                                SHA256

                                                                                                                                54c99d5642ff938d295a711dee01ea4ec5509e110468d312fcefef50b4d75454

                                                                                                                                SHA512

                                                                                                                                cffe2a37f9634f119b3457c2ea484e93872b44da70ffacd85b218dd126b8161f26fcf7ce3bdd97248e1af05911301ed1816ab3bfc0d6e8bca7fac0e49bdb4c16

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                3b245fb7f60a1e2991a349e23f466465

                                                                                                                                SHA1

                                                                                                                                e2cc45f8251023603004cf2e828274f331e7c327

                                                                                                                                SHA256

                                                                                                                                db83bdd5dd8c1f9a4cf0bcb749684d2118b38f139eeb329009f7645a328f127e

                                                                                                                                SHA512

                                                                                                                                dddea2457ebda299b93009e7501ebfa92807c7eda86b9c8ed7965018cceb78b5b10931463458971d084fefc75fd6329ef7263436e2b93af22799ce0c2296689b

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                3b245fb7f60a1e2991a349e23f466465

                                                                                                                                SHA1

                                                                                                                                e2cc45f8251023603004cf2e828274f331e7c327

                                                                                                                                SHA256

                                                                                                                                db83bdd5dd8c1f9a4cf0bcb749684d2118b38f139eeb329009f7645a328f127e

                                                                                                                                SHA512

                                                                                                                                dddea2457ebda299b93009e7501ebfa92807c7eda86b9c8ed7965018cceb78b5b10931463458971d084fefc75fd6329ef7263436e2b93af22799ce0c2296689b

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Google\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                4fe0082ea4a561e8b7a84bb07e20298b

                                                                                                                                SHA1

                                                                                                                                ef5f933ed1f3ec29742a8a723b242c00bbee00ef

                                                                                                                                SHA256

                                                                                                                                a5cea8ed730b763d82590ff23603149fec0c454ce98ef85a538613323ffc48ac

                                                                                                                                SHA512

                                                                                                                                4ce35a173552369be7be8fa552733b8c63c844097383442dafc2e072eb75340421d623d5093fbf20938548e5a5cd9b60c85847ee2949c1d12c90dd032853f0ab

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\Google\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                4fe0082ea4a561e8b7a84bb07e20298b

                                                                                                                                SHA1

                                                                                                                                ef5f933ed1f3ec29742a8a723b242c00bbee00ef

                                                                                                                                SHA256

                                                                                                                                a5cea8ed730b763d82590ff23603149fec0c454ce98ef85a538613323ffc48ac

                                                                                                                                SHA512

                                                                                                                                4ce35a173552369be7be8fa552733b8c63c844097383442dafc2e072eb75340421d623d5093fbf20938548e5a5cd9b60c85847ee2949c1d12c90dd032853f0ab

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                35345860cb574f09f285dbb537a92749

                                                                                                                                SHA1

                                                                                                                                9a8b4ad8ac1380745d62f1ae5e4bcac401f6eb10

                                                                                                                                SHA256

                                                                                                                                33906d28f2c095c8d0b7e60f410aecb4df534029926bed41ea0cf1f9ea9ffcf1

                                                                                                                                SHA512

                                                                                                                                254e62ec20eee6585f79ecb17d49e6849f1de16959d8e7aee0d5ac3dd8471b37e8435dea72f3da2508da1661731a5f78f88ae3cf797a02246d2c8fbd7a1eef55

                                                                                                                                Download Submit

                                                                                                                              • C:\Program Files\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                35345860cb574f09f285dbb537a92749

                                                                                                                                SHA1

                                                                                                                                9a8b4ad8ac1380745d62f1ae5e4bcac401f6eb10

                                                                                                                                SHA256

                                                                                                                                33906d28f2c095c8d0b7e60f410aecb4df534029926bed41ea0cf1f9ea9ffcf1

                                                                                                                                SHA512

                                                                                                                                254e62ec20eee6585f79ecb17d49e6849f1de16959d8e7aee0d5ac3dd8471b37e8435dea72f3da2508da1661731a5f78f88ae3cf797a02246d2c8fbd7a1eef55

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1742477204\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                dd33560bda672c09385ae1cacbb86b98

                                                                                                                                SHA1

                                                                                                                                ec85dde9f44317275a231aaa405f684467b1f19b

                                                                                                                                SHA256

                                                                                                                                6d5432f7bbe968e1a846ca09092552f5a5359afdf0c09de8e3b88165491c61e9

                                                                                                                                SHA512

                                                                                                                                e4dab28217a3f739d837fa22eeadfde3f929e1f0aa99f45c0c0e2a934cda13cf52f924cfcfdbf1d1e1759edf3a0ee31fdb1470e9b0c271928daee0f6e402b528

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\1742477204\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                dd33560bda672c09385ae1cacbb86b98

                                                                                                                                SHA1

                                                                                                                                ec85dde9f44317275a231aaa405f684467b1f19b

                                                                                                                                SHA256

                                                                                                                                6d5432f7bbe968e1a846ca09092552f5a5359afdf0c09de8e3b88165491c61e9

                                                                                                                                SHA512

                                                                                                                                e4dab28217a3f739d837fa22eeadfde3f929e1f0aa99f45c0c0e2a934cda13cf52f924cfcfdbf1d1e1759edf3a0ee31fdb1470e9b0c271928daee0f6e402b528

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                9d371aafcd6586b3271eff96e852a7dc

                                                                                                                                SHA1

                                                                                                                                3d5a5e3315497623bbaabec34d895c0a1dd33ba0

                                                                                                                                SHA256

                                                                                                                                0574342631b48c96ac06df88b00512d0b228ccfc752148e96bc007d60ad1997e

                                                                                                                                SHA512

                                                                                                                                e798f6a9b8c4754c873838f09d01aa70dfd608908afcf6b42fcee2398a79615be22c9f4eb174647e73bb2b21c7a5900dc49e27b0ae5430004c6fe112e788e8b0

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                9d371aafcd6586b3271eff96e852a7dc

                                                                                                                                SHA1

                                                                                                                                3d5a5e3315497623bbaabec34d895c0a1dd33ba0

                                                                                                                                SHA256

                                                                                                                                0574342631b48c96ac06df88b00512d0b228ccfc752148e96bc007d60ad1997e

                                                                                                                                SHA512

                                                                                                                                e798f6a9b8c4754c873838f09d01aa70dfd608908afcf6b42fcee2398a79615be22c9f4eb174647e73bb2b21c7a5900dc49e27b0ae5430004c6fe112e788e8b0

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                9d371aafcd6586b3271eff96e852a7dc

                                                                                                                                SHA1

                                                                                                                                3d5a5e3315497623bbaabec34d895c0a1dd33ba0

                                                                                                                                SHA256

                                                                                                                                0574342631b48c96ac06df88b00512d0b228ccfc752148e96bc007d60ad1997e

                                                                                                                                SHA512

                                                                                                                                e798f6a9b8c4754c873838f09d01aa70dfd608908afcf6b42fcee2398a79615be22c9f4eb174647e73bb2b21c7a5900dc49e27b0ae5430004c6fe112e788e8b0

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                9d371aafcd6586b3271eff96e852a7dc

                                                                                                                                SHA1

                                                                                                                                3d5a5e3315497623bbaabec34d895c0a1dd33ba0

                                                                                                                                SHA256

                                                                                                                                0574342631b48c96ac06df88b00512d0b228ccfc752148e96bc007d60ad1997e

                                                                                                                                SHA512

                                                                                                                                e798f6a9b8c4754c873838f09d01aa70dfd608908afcf6b42fcee2398a79615be22c9f4eb174647e73bb2b21c7a5900dc49e27b0ae5430004c6fe112e788e8b0

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                60cc307eee70649a419a511a2a4a704f

                                                                                                                                SHA1

                                                                                                                                ffddc9f8ceb840707ddac85f88e2ec1f0e07a2c4

                                                                                                                                SHA256

                                                                                                                                ed842bbdc0683ff9ca25bc3fbb92a4d54d57d5fc43b1893acd8c3a94ff10a60d

                                                                                                                                SHA512

                                                                                                                                17bb581a0eef0b0441a49ef569d633ea6951c0b14d882c1e6bcebf7b92b9fb4e63cdeb04680e0dd0e6c1dd01eb6b27d63ac3788399521828f04fa66052da314e

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                60cc307eee70649a419a511a2a4a704f

                                                                                                                                SHA1

                                                                                                                                ffddc9f8ceb840707ddac85f88e2ec1f0e07a2c4

                                                                                                                                SHA256

                                                                                                                                ed842bbdc0683ff9ca25bc3fbb92a4d54d57d5fc43b1893acd8c3a94ff10a60d

                                                                                                                                SHA512

                                                                                                                                17bb581a0eef0b0441a49ef569d633ea6951c0b14d882c1e6bcebf7b92b9fb4e63cdeb04680e0dd0e6c1dd01eb6b27d63ac3788399521828f04fa66052da314e

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                804867bb04178d5f5df1829a12096972

                                                                                                                                SHA1

                                                                                                                                3d5e4d63c318218718644f3db7ee07e6cc561fb5

                                                                                                                                SHA256

                                                                                                                                672f7930e10686ad91d797c03755ba09db1724f3a058783af2e26b08f93b1c99

                                                                                                                                SHA512

                                                                                                                                0c43fcae2b942f913ea0aa6b4e89e3d3b26cbfcda341f6112f4e29e13afa861e35e83973dafbdba91411f7bed1730b5afdcbe451353ec473559e0f29e01d7128

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                804867bb04178d5f5df1829a12096972

                                                                                                                                SHA1

                                                                                                                                3d5e4d63c318218718644f3db7ee07e6cc561fb5

                                                                                                                                SHA256

                                                                                                                                672f7930e10686ad91d797c03755ba09db1724f3a058783af2e26b08f93b1c99

                                                                                                                                SHA512

                                                                                                                                0c43fcae2b942f913ea0aa6b4e89e3d3b26cbfcda341f6112f4e29e13afa861e35e83973dafbdba91411f7bed1730b5afdcbe451353ec473559e0f29e01d7128

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                ac0b7e684ecbab2b81c3ac8aa8090b2a

                                                                                                                                SHA1

                                                                                                                                84f930ad725205454b2b459c01096aba73da5b05

                                                                                                                                SHA256

                                                                                                                                885c5d011e3f4aea173a95e2f0f1da437edb909319c54e7bf3d5f384bef943f4

                                                                                                                                SHA512

                                                                                                                                cb89c01aa35d2a7034afbe85786254cea357d96280808eb823690014c31198696c0fdadd6fce59302633e1384185426cccc4dd3859bbac56366c08ab56ccff8b

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                ac0b7e684ecbab2b81c3ac8aa8090b2a

                                                                                                                                SHA1

                                                                                                                                84f930ad725205454b2b459c01096aba73da5b05

                                                                                                                                SHA256

                                                                                                                                885c5d011e3f4aea173a95e2f0f1da437edb909319c54e7bf3d5f384bef943f4

                                                                                                                                SHA512

                                                                                                                                cb89c01aa35d2a7034afbe85786254cea357d96280808eb823690014c31198696c0fdadd6fce59302633e1384185426cccc4dd3859bbac56366c08ab56ccff8b

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                60cc307eee70649a419a511a2a4a704f

                                                                                                                                SHA1

                                                                                                                                ffddc9f8ceb840707ddac85f88e2ec1f0e07a2c4

                                                                                                                                SHA256

                                                                                                                                ed842bbdc0683ff9ca25bc3fbb92a4d54d57d5fc43b1893acd8c3a94ff10a60d

                                                                                                                                SHA512

                                                                                                                                17bb581a0eef0b0441a49ef569d633ea6951c0b14d882c1e6bcebf7b92b9fb4e63cdeb04680e0dd0e6c1dd01eb6b27d63ac3788399521828f04fa66052da314e

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                60cc307eee70649a419a511a2a4a704f

                                                                                                                                SHA1

                                                                                                                                ffddc9f8ceb840707ddac85f88e2ec1f0e07a2c4

                                                                                                                                SHA256

                                                                                                                                ed842bbdc0683ff9ca25bc3fbb92a4d54d57d5fc43b1893acd8c3a94ff10a60d

                                                                                                                                SHA512

                                                                                                                                17bb581a0eef0b0441a49ef569d633ea6951c0b14d882c1e6bcebf7b92b9fb4e63cdeb04680e0dd0e6c1dd01eb6b27d63ac3788399521828f04fa66052da314e

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                2a04a6a073d582c1715dc89718e316a6

                                                                                                                                SHA1

                                                                                                                                975ae797cdc805ce6a0d0bee358aa1543d774d20

                                                                                                                                SHA256

                                                                                                                                f9b952c65cf3f9adbe83873d396ff0da3baf4154df0de6340dbcda23c967799f

                                                                                                                                SHA512

                                                                                                                                1aae608a057b13a2a0087c7e57f99afbce03b714d1703daff42f0818379824530cb5ee125ef7c9d71bc613a2673d9ceb8e218e80568449a66917953749aaaef7

                                                                                                                                Download Submit

                                                                                                                              • C:\Users\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                2a04a6a073d582c1715dc89718e316a6

                                                                                                                                SHA1

                                                                                                                                975ae797cdc805ce6a0d0bee358aa1543d774d20

                                                                                                                                SHA256

                                                                                                                                f9b952c65cf3f9adbe83873d396ff0da3baf4154df0de6340dbcda23c967799f

                                                                                                                                SHA512

                                                                                                                                1aae608a057b13a2a0087c7e57f99afbce03b714d1703daff42f0818379824530cb5ee125ef7c9d71bc613a2673d9ceb8e218e80568449a66917953749aaaef7

                                                                                                                                Download Submit

                                                                                                                              • C:\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                c89cc36b039c8ff3c2634ef2e55e536f

                                                                                                                                SHA1

                                                                                                                                5b58c104949c229465d6d94b28a98621f2cdd206

                                                                                                                                SHA256

                                                                                                                                6879488cb354e40e29cb9233e26bd044764a38e645ec5dbbf4af3cb07fe55919

                                                                                                                                SHA512

                                                                                                                                cbb784404be6b0a307774c5e614a79301179fdb6d8c4641bd7492c29592e9864d0d46c90a7dcd899e52b7f39d84afaf3e0aff2662bc73b79964cd413638bc3b1

                                                                                                                                Download Submit

                                                                                                                              • C:\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                c89cc36b039c8ff3c2634ef2e55e536f

                                                                                                                                SHA1

                                                                                                                                5b58c104949c229465d6d94b28a98621f2cdd206

                                                                                                                                SHA256

                                                                                                                                6879488cb354e40e29cb9233e26bd044764a38e645ec5dbbf4af3cb07fe55919

                                                                                                                                SHA512

                                                                                                                                cbb784404be6b0a307774c5e614a79301179fdb6d8c4641bd7492c29592e9864d0d46c90a7dcd899e52b7f39d84afaf3e0aff2662bc73b79964cd413638bc3b1

                                                                                                                                Download Submit

                                                                                                                              • C:\odt\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                2341ea55e0e8729c605beff4550da7ec

                                                                                                                                SHA1

                                                                                                                                03280097aed84384216d517e3ca46ad871e9374f

                                                                                                                                SHA256

                                                                                                                                b0415445ca27b685ab343303da865274dd91c8b0b4a8e545d22a9ed9d900c842

                                                                                                                                SHA512

                                                                                                                                df912aeb7d56f38a2d8ea0248b605f686331e1e6ddd3823e140d578b43cfc822edb3b00be0df42069a66993813c5978988a4f08d263c938d9bc33e91ccd76603

                                                                                                                                Download Submit

                                                                                                                              • C:\odt\backup.exe
                                                                                                                                Filesize

                                                                                                                                72KB

                                                                                                                                MD5

                                                                                                                                2341ea55e0e8729c605beff4550da7ec

                                                                                                                                SHA1

                                                                                                                                03280097aed84384216d517e3ca46ad871e9374f

                                                                                                                                SHA256

                                                                                                                                b0415445ca27b685ab343303da865274dd91c8b0b4a8e545d22a9ed9d900c842

                                                                                                                                SHA512

                                                                                                                                df912aeb7d56f38a2d8ea0248b605f686331e1e6ddd3823e140d578b43cfc822edb3b00be0df42069a66993813c5978988a4f08d263c938d9bc33e91ccd76603

                                                                                                                                Download Submit