Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    190s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/12/2022, 19:51

General

  • Target

    e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe

  • Size

    72KB

  • MD5

    089486ab489ab4f97ce70cba78a50961

  • SHA1

    c86bcc5b33c46817d459523cd84a81675d1be81c

  • SHA256

    e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e

  • SHA512

    5d462d7449e6de7910fa476c5688dbb2718531a550d48c0ebf90012a3bc9dd1b4cfdb9e018620c2208019213db5cb34b35b194ab1bedd43a9d2b708c2045c2b6

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2D:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP3

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
    "C:\Users\Admin\AppData\Local\Temp\e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Users\Admin\AppData\Local\Temp\1245620864\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1245620864\backup.exe C:\Users\Admin\AppData\Local\Temp\1245620864\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3176
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4780
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1936
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3060
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4388
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1032
            • C:\Program Files\7-Zip\Lang\data.exe
              "C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4364
          • C:\Program Files\Common Files\data.exe
            "C:\Program Files\Common Files\data.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4368
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4904
            • C:\Program Files\Common Files\microsoft shared\data.exe
              "C:\Program Files\Common Files\microsoft shared\data.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3528
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4424
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:3812
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1908
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2260
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2168
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3372
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2644
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4152
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2892
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                    PID:1908
                  • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:4280
                  • C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\es-MX\data.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:3968
                  • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:932
                  • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:2752
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                    8⤵
                      PID:3224
                    • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                      8⤵
                        PID:4964
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\update.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                        8⤵
                          PID:1924
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                        7⤵
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        PID:4784
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:3612
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1748
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:2236
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:632
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:3280
                        • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                          8⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:4308
                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Drops file in Program Files directory
                        PID:744
                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:3372
                      • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:4880
                      • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                        7⤵
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:4596
                      • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:1792
                      • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                        7⤵
                        • System policy modification
                        PID:2468
                        • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                          8⤵
                            PID:2884
                        • C:\Program Files\Common Files\microsoft shared\Triedit\update.exe
                          "C:\Program Files\Common Files\microsoft shared\Triedit\update.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                          7⤵
                            PID:2652
                            • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                              8⤵
                                PID:2748
                          • C:\Program Files\Common Files\Services\backup.exe
                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                            6⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:372
                          • C:\Program Files\Common Files\System\backup.exe
                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:3568
                            • C:\Program Files\Common Files\System\ado\backup.exe
                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              PID:2760
                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4000
                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                8⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4352
                              • C:\Program Files\Common Files\System\ado\es-ES\update.exe
                                "C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:5072
                              • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                8⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2568
                              • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                8⤵
                                • System policy modification
                                PID:3300
                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                PID:2392
                            • C:\Program Files\Common Files\System\de-DE\backup.exe
                              "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:4252
                            • C:\Program Files\Common Files\System\en-US\backup.exe
                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:3024
                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                              7⤵
                                PID:756
                              • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                PID:3920
                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • System policy modification
                                PID:3300
                              • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                7⤵
                                • Disables RegEdit via registry modification
                                PID:3736
                              • C:\Program Files\Common Files\System\msadc\System Restore.exe
                                "C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\
                                7⤵
                                  PID:3124
                            • C:\Program Files\Google\backup.exe
                              "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                              5⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1632
                              • C:\Program Files\Google\Chrome\backup.exe
                                "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1292
                                • C:\Program Files\Google\Chrome\Application\backup.exe
                                  "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:2804
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1560
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1468
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:3736
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                      9⤵
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:4396
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                      9⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:2884
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                      9⤵
                                        PID:1000
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                        9⤵
                                          PID:3988
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                          9⤵
                                          • System policy modification
                                          PID:2840
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                          9⤵
                                          • Disables RegEdit via registry modification
                                          PID:3052
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                            10⤵
                                            • Disables RegEdit via registry modification
                                            • Drops file in Program Files directory
                                            PID:1684
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                              11⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System policy modification
                                              PID:2060
                                      • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                        8⤵
                                        • Executes dropped EXE
                                        • System policy modification
                                        PID:2944
                                • C:\Program Files\Internet Explorer\backup.exe
                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                  5⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:5048
                                  • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3556
                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2104
                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3224
                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:4720
                                  • C:\Program Files\Internet Explorer\images\update.exe
                                    "C:\Program Files\Internet Explorer\images\update.exe" C:\Program Files\Internet Explorer\images\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    PID:2612
                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:1708
                                  • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                    "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:4988
                                  • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                    "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                    6⤵
                                    • System policy modification
                                    PID:1304
                                • C:\Program Files\Java\backup.exe
                                  "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                  5⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • System policy modification
                                  PID:2932
                                  • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                    "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    PID:2988
                                    • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                      "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                      7⤵
                                        PID:1928
                                      • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                        "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                        7⤵
                                        • Drops file in Program Files directory
                                        PID:3320
                                        • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                          "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                          8⤵
                                            PID:4744
                                          • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                            "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                            8⤵
                                              PID:1048
                                          • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                            "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                            7⤵
                                              PID:3552
                                              • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                8⤵
                                                  PID:4860
                                              • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                7⤵
                                                  PID:4936
                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                    8⤵
                                                      PID:3556
                                                • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                  "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                  6⤵
                                                  • Disables RegEdit via registry modification
                                                  • Drops file in Program Files directory
                                                  • System policy modification
                                                  PID:1112
                                                  • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                    "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                    7⤵
                                                      PID:2420
                                                • C:\Program Files\Microsoft Office\backup.exe
                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                  5⤵
                                                  • Disables RegEdit via registry modification
                                                  • Drops file in Program Files directory
                                                  • System policy modification
                                                  PID:4072
                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                    6⤵
                                                      PID:3564
                                                    • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                      "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                      6⤵
                                                        PID:1180
                                                    • C:\Program Files\Microsoft Office 15\backup.exe
                                                      "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                      5⤵
                                                        PID:896
                                                        • C:\Program Files\Microsoft Office 15\ClientX64\update.exe
                                                          "C:\Program Files\Microsoft Office 15\ClientX64\update.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                          6⤵
                                                            PID:2012
                                                      • C:\Program Files (x86)\backup.exe
                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                        4⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:524
                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                          5⤵
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1876
                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe
                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:2144
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                              7⤵
                                                              • Disables RegEdit via registry modification
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:3268
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:1644
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:668
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                  9⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1992
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:2904
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                  9⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • System policy modification
                                                                  PID:3572
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:4732
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                PID:3272
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\System Restore.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                • System policy modification
                                                                PID:1312
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                  9⤵
                                                                    PID:2776
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  • Drops file in Program Files directory
                                                                  PID:3980
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                    9⤵
                                                                      PID:668
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                    8⤵
                                                                      PID:3220
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                      8⤵
                                                                        PID:3276
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                          9⤵
                                                                            PID:3788
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                        7⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Drops file in Program Files directory
                                                                        PID:4140
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          PID:3716
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            PID:3500
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System policy modification
                                                                          PID:3956
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:4368
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                            9⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Drops file in Program Files directory
                                                                            • System policy modification
                                                                            PID:2168
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                              10⤵
                                                                              • System policy modification
                                                                              PID:4700
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                              10⤵
                                                                                PID:2344
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                          7⤵
                                                                          • System policy modification
                                                                          PID:2096
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                            8⤵
                                                                              PID:1536
                                                                      • C:\Program Files (x86)\Common Files\backup.exe
                                                                        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Drops file in Program Files directory
                                                                        • System policy modification
                                                                        PID:4328
                                                                        • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                          "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                          6⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          PID:316
                                                                          • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • System policy modification
                                                                            PID:3080
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                            7⤵
                                                                              PID:1648
                                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:3948
                                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                              7⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:4720
                                                                              • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                8⤵
                                                                                  PID:4152
                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                7⤵
                                                                                  PID:4540
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                    8⤵
                                                                                      PID:3304
                                                                                • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                  "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                  6⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  PID:1844
                                                                                  • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                    7⤵
                                                                                      PID:4588
                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe
                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\data.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                    6⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Program Files directory
                                                                                    PID:2744
                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                      7⤵
                                                                                        PID:4084
                                                                                    • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                      6⤵
                                                                                        PID:2888
                                                                                      • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                        6⤵
                                                                                          PID:4092
                                                                                      • C:\Program Files (x86)\Google\backup.exe
                                                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                        5⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        PID:4336
                                                                                        • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                          "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                          6⤵
                                                                                            PID:1904
                                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                          5⤵
                                                                                            PID:4280
                                                                                            • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                              "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                              6⤵
                                                                                                PID:3776
                                                                                            • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                              "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                              5⤵
                                                                                                PID:2084
                                                                                            • C:\Users\backup.exe
                                                                                              C:\Users\backup.exe C:\Users\
                                                                                              4⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:3156
                                                                                              • C:\Users\Admin\backup.exe
                                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                5⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:2788
                                                                                                • C:\Users\Admin\3D Objects\backup.exe
                                                                                                  "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                  6⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1476
                                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                  6⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:4296
                                                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                  6⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:3576
                                                                                                • C:\Users\Admin\Documents\backup.exe
                                                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                  6⤵
                                                                                                    PID:3268
                                                                                                  • C:\Users\Admin\Downloads\backup.exe
                                                                                                    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • System policy modification
                                                                                                    PID:2916
                                                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                    6⤵
                                                                                                      PID:1476
                                                                                                    • C:\Users\Admin\Links\backup.exe
                                                                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                      6⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • System policy modification
                                                                                                      PID:1608
                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                      6⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:1764
                                                                                                    • C:\Users\Admin\OneDrive\backup.exe
                                                                                                      C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                      6⤵
                                                                                                        PID:312
                                                                                                    • C:\Users\Public\backup.exe
                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                      5⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:1272
                                                                                                      • C:\Users\Public\Documents\backup.exe
                                                                                                        C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                        6⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        PID:1564
                                                                                                      • C:\Users\Public\Downloads\backup.exe
                                                                                                        C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                        6⤵
                                                                                                          PID:2416
                                                                                                        • C:\Users\Public\Music\backup.exe
                                                                                                          C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • System policy modification
                                                                                                          PID:3328
                                                                                                        • C:\Users\Public\Pictures\backup.exe
                                                                                                          C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                          6⤵
                                                                                                          • System policy modification
                                                                                                          PID:4784
                                                                                                        • C:\Users\Public\Videos\backup.exe
                                                                                                          C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                          6⤵
                                                                                                            PID:4524
                                                                                                      • C:\Windows\backup.exe
                                                                                                        C:\Windows\backup.exe C:\Windows\
                                                                                                        4⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:4696
                                                                                                        • C:\Windows\addins\backup.exe
                                                                                                          C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                          5⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • System policy modification
                                                                                                          PID:1824
                                                                                                        • C:\Windows\appcompat\backup.exe
                                                                                                          C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                          5⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          • System policy modification
                                                                                                          PID:3540
                                                                                                          • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                            C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Drops file in Windows directory
                                                                                                            • System policy modification
                                                                                                            PID:1292
                                                                                                            • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                              C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                              7⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:4000
                                                                                                          • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                            C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                            6⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:3576
                                                                                                          • C:\Windows\appcompat\Programs\backup.exe
                                                                                                            C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                            6⤵
                                                                                                              PID:2800
                                                                                                          • C:\Windows\apppatch\backup.exe
                                                                                                            C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                            5⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Drops file in Windows directory
                                                                                                            • System policy modification
                                                                                                            PID:2804
                                                                                                            • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                              C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                              6⤵
                                                                                                                PID:176
                                                                                                              • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                6⤵
                                                                                                                  PID:4760
                                                                                                              • C:\Windows\AppReadiness\backup.exe
                                                                                                                C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                                                                                5⤵
                                                                                                                  PID:1812
                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                  5⤵
                                                                                                                    PID:1304
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:2956
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:4352
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                              2⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3080
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                              2⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:3392
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                              2⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              • System policy modification
                                                                                                              PID:1200
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                              2⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              • System policy modification
                                                                                                              PID:320

                                                                                                          Network

                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                          Replay Monitor

                                                                                                          Loading Replay Monitor...

                                                                                                          Downloads

                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            11d46e1386e8e8a79406d158969e1e75

                                                                                                            SHA1

                                                                                                            2c7a4963c5c57e2ed497e79e47516f49b04bdbf4

                                                                                                            SHA256

                                                                                                            65e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209

                                                                                                            SHA512

                                                                                                            a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2

                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            11d46e1386e8e8a79406d158969e1e75

                                                                                                            SHA1

                                                                                                            2c7a4963c5c57e2ed497e79e47516f49b04bdbf4

                                                                                                            SHA256

                                                                                                            65e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209

                                                                                                            SHA512

                                                                                                            a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2

                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            1affb0f3368dd26fbe0079af0d6c0d0d

                                                                                                            SHA1

                                                                                                            655a4af03c8e3d6dd5fa8065ef57b6fca01679a5

                                                                                                            SHA256

                                                                                                            d0736721680e067f2221b48ff9fa74add19a79302c8d580c8539f082c42123b0

                                                                                                            SHA512

                                                                                                            98313b5c36987bae280b6967d9b51b5ef35062d470d63c8ab6b8c449ae458ab5f74983bbe5c5a5571b96ecaa06e8225bb4b7f415f286b720c74c10450887de86

                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\System Restore.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            1affb0f3368dd26fbe0079af0d6c0d0d

                                                                                                            SHA1

                                                                                                            655a4af03c8e3d6dd5fa8065ef57b6fca01679a5

                                                                                                            SHA256

                                                                                                            d0736721680e067f2221b48ff9fa74add19a79302c8d580c8539f082c42123b0

                                                                                                            SHA512

                                                                                                            98313b5c36987bae280b6967d9b51b5ef35062d470d63c8ab6b8c449ae458ab5f74983bbe5c5a5571b96ecaa06e8225bb4b7f415f286b720c74c10450887de86

                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            70419d478796e00f90d573976217c32e

                                                                                                            SHA1

                                                                                                            f6c11d393e841a986c581a3e756f92ddf56b5cb7

                                                                                                            SHA256

                                                                                                            a0a19a0868a22402020f60a6b7c8232239819e32a68718f513d7187094019a81

                                                                                                            SHA512

                                                                                                            2dd66a8edd50970430ab489fd1b0a861bb3ad57910dd31a700f6aae17e427c3e902bb8a128f9df895022f2e0a2e83fb1fde16e17ca59d3c8cbf6ae8f3f75be4f

                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            70419d478796e00f90d573976217c32e

                                                                                                            SHA1

                                                                                                            f6c11d393e841a986c581a3e756f92ddf56b5cb7

                                                                                                            SHA256

                                                                                                            a0a19a0868a22402020f60a6b7c8232239819e32a68718f513d7187094019a81

                                                                                                            SHA512

                                                                                                            2dd66a8edd50970430ab489fd1b0a861bb3ad57910dd31a700f6aae17e427c3e902bb8a128f9df895022f2e0a2e83fb1fde16e17ca59d3c8cbf6ae8f3f75be4f

                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            15fbdd7841579f86c5944e729777bee7

                                                                                                            SHA1

                                                                                                            0aabc260c4a6fe63751baaf3a2d21f67f52770a6

                                                                                                            SHA256

                                                                                                            bc175ac0bda13f03387e19ca7e676351aeca458ccb114bef9293673b6339525f

                                                                                                            SHA512

                                                                                                            a3420fbd4a9a7fae8b034c4b11c4009b5f990f85a49c23e0353ab0cc02671102215f747f80a061ef62084572d2b5332c6fbe195f8a8ef263eaf36bed00105dd3

                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            15fbdd7841579f86c5944e729777bee7

                                                                                                            SHA1

                                                                                                            0aabc260c4a6fe63751baaf3a2d21f67f52770a6

                                                                                                            SHA256

                                                                                                            bc175ac0bda13f03387e19ca7e676351aeca458ccb114bef9293673b6339525f

                                                                                                            SHA512

                                                                                                            a3420fbd4a9a7fae8b034c4b11c4009b5f990f85a49c23e0353ab0cc02671102215f747f80a061ef62084572d2b5332c6fbe195f8a8ef263eaf36bed00105dd3

                                                                                                          • C:\Program Files\7-Zip\Lang\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9e56078fd77241c368ba30a0ae556e2f

                                                                                                            SHA1

                                                                                                            b3b4982b7dc541c3c381cebe2bebec977bc9a539

                                                                                                            SHA256

                                                                                                            92d2ecc9f27369ffb308e0a19abc99a5f32fdc64d09fc55fbb9933a15709b44e

                                                                                                            SHA512

                                                                                                            7583f850b4dc529ef05b6a8cdbce1544cc399c75cd9452bb22fa4beb25409294d83b53ee11caefd88e74d2f552d2800fcc7ab7401537d19b01050fea9b5edf06

                                                                                                          • C:\Program Files\7-Zip\Lang\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9e56078fd77241c368ba30a0ae556e2f

                                                                                                            SHA1

                                                                                                            b3b4982b7dc541c3c381cebe2bebec977bc9a539

                                                                                                            SHA256

                                                                                                            92d2ecc9f27369ffb308e0a19abc99a5f32fdc64d09fc55fbb9933a15709b44e

                                                                                                            SHA512

                                                                                                            7583f850b4dc529ef05b6a8cdbce1544cc399c75cd9452bb22fa4beb25409294d83b53ee11caefd88e74d2f552d2800fcc7ab7401537d19b01050fea9b5edf06

                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c2d7cfe479e889f3f238ef792de7a7e5

                                                                                                            SHA1

                                                                                                            50b2742c875c93fd40c6e388d209134699c37abf

                                                                                                            SHA256

                                                                                                            7483ed7fd8f8e2f58770c674e145c6610f7fd4fddc9fb3e3b5850dbdfc4981ec

                                                                                                            SHA512

                                                                                                            821732856bdc4403b891f0a5fd636f54ba71e72f4faf34aa00d53461e61f200fe68d3669152501ec8a33c659acd75ffd283875d214d230dd083bd30bc273385d

                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c2d7cfe479e889f3f238ef792de7a7e5

                                                                                                            SHA1

                                                                                                            50b2742c875c93fd40c6e388d209134699c37abf

                                                                                                            SHA256

                                                                                                            7483ed7fd8f8e2f58770c674e145c6610f7fd4fddc9fb3e3b5850dbdfc4981ec

                                                                                                            SHA512

                                                                                                            821732856bdc4403b891f0a5fd636f54ba71e72f4faf34aa00d53461e61f200fe68d3669152501ec8a33c659acd75ffd283875d214d230dd083bd30bc273385d

                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            33f89961ca785056e63cbc0306a9507f

                                                                                                            SHA1

                                                                                                            628b436b332bd72d54c5f343caaa2f6456ac0618

                                                                                                            SHA256

                                                                                                            7330fba249b74011f1e46db4556e0009eb4d3394f82f0583ec49b54e24cab0cb

                                                                                                            SHA512

                                                                                                            9466b233409dc2eff043b729e390668e07fa348001f28b1e57dcc017b8045e3dee53ac3f486899adff7c5940b84feecfa58ee89c0ffc6a458f3ab477f26436ff

                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            33f89961ca785056e63cbc0306a9507f

                                                                                                            SHA1

                                                                                                            628b436b332bd72d54c5f343caaa2f6456ac0618

                                                                                                            SHA256

                                                                                                            7330fba249b74011f1e46db4556e0009eb4d3394f82f0583ec49b54e24cab0cb

                                                                                                            SHA512

                                                                                                            9466b233409dc2eff043b729e390668e07fa348001f28b1e57dcc017b8045e3dee53ac3f486899adff7c5940b84feecfa58ee89c0ffc6a458f3ab477f26436ff

                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            2a8f34236ba23d29d94c88ae53d7f997

                                                                                                            SHA1

                                                                                                            fa6d307a141c8a8eadde894118ca6e66ee317aaf

                                                                                                            SHA256

                                                                                                            1cfb1484d5b43e5be63151a3bd828799d5f549d31523b9588cf806ec7515baf7

                                                                                                            SHA512

                                                                                                            bab0b251e5a4e1748b386f217a9adde92e75c2c06ffff5ecd32ca37c01c43cf7370a10bcb21867883cf887b1878ed89f9ff22e21c670283150ff42b2c26c132c

                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            2a8f34236ba23d29d94c88ae53d7f997

                                                                                                            SHA1

                                                                                                            fa6d307a141c8a8eadde894118ca6e66ee317aaf

                                                                                                            SHA256

                                                                                                            1cfb1484d5b43e5be63151a3bd828799d5f549d31523b9588cf806ec7515baf7

                                                                                                            SHA512

                                                                                                            bab0b251e5a4e1748b386f217a9adde92e75c2c06ffff5ecd32ca37c01c43cf7370a10bcb21867883cf887b1878ed89f9ff22e21c670283150ff42b2c26c132c

                                                                                                          • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9c1fb5875d2b7a3c51a3fbfa34d84437

                                                                                                            SHA1

                                                                                                            03e3c8477d1f059a6bbaeb5d848bfa5965e90bfc

                                                                                                            SHA256

                                                                                                            e723cf8b9950d139f1969f04e0f9edcf9ec8e27fed4e0fbd8f06a30c69fbdf9f

                                                                                                            SHA512

                                                                                                            7ac69e81c285f8a7590787498b3e0e83cf1b119e69b78d4e344848e8a4b873cd698c7476ea0f188f7b323f9d81afc5d347d0b9c943b7722f25926f74a29e4340

                                                                                                          • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9c1fb5875d2b7a3c51a3fbfa34d84437

                                                                                                            SHA1

                                                                                                            03e3c8477d1f059a6bbaeb5d848bfa5965e90bfc

                                                                                                            SHA256

                                                                                                            e723cf8b9950d139f1969f04e0f9edcf9ec8e27fed4e0fbd8f06a30c69fbdf9f

                                                                                                            SHA512

                                                                                                            7ac69e81c285f8a7590787498b3e0e83cf1b119e69b78d4e344848e8a4b873cd698c7476ea0f188f7b323f9d81afc5d347d0b9c943b7722f25926f74a29e4340

                                                                                                          • C:\Program Files\Common Files\System\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9e5ca6b31678bb4b0ab62b7874def36f

                                                                                                            SHA1

                                                                                                            69846a3542da5c885965cd0cab794094e376f212

                                                                                                            SHA256

                                                                                                            ab471f0f6a1a37a31f13d3549120acadd46dd45c205297fc89ca6f8569985bb2

                                                                                                            SHA512

                                                                                                            9d6031b7e3ad9405e45bdc43b61688519230eb42240d07ed8c8140870d1f6fc42c8065b02edb751c45eb222cfa3c5d0753949fe653576cadc34fef790f2b8a49

                                                                                                          • C:\Program Files\Common Files\System\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9e5ca6b31678bb4b0ab62b7874def36f

                                                                                                            SHA1

                                                                                                            69846a3542da5c885965cd0cab794094e376f212

                                                                                                            SHA256

                                                                                                            ab471f0f6a1a37a31f13d3549120acadd46dd45c205297fc89ca6f8569985bb2

                                                                                                            SHA512

                                                                                                            9d6031b7e3ad9405e45bdc43b61688519230eb42240d07ed8c8140870d1f6fc42c8065b02edb751c45eb222cfa3c5d0753949fe653576cadc34fef790f2b8a49

                                                                                                          • C:\Program Files\Common Files\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            929046faae79669e01861a949f0f00b4

                                                                                                            SHA1

                                                                                                            90b2d8ed0e74c8d5d98389187a2f3966b4c38eaf

                                                                                                            SHA256

                                                                                                            fc51c1d409d5facdc38f60bcc0db51b68e40adec7efb908d6f8d11799de91896

                                                                                                            SHA512

                                                                                                            00ea226b62126048a3c6c200baa39063ccc972689dd9ee8cea9fa6978dd7f7872d706a4b209458c9a931d8f45b9e5d4ae5b3e8bafe80ce401f5d4c3f41e9f008

                                                                                                          • C:\Program Files\Common Files\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            929046faae79669e01861a949f0f00b4

                                                                                                            SHA1

                                                                                                            90b2d8ed0e74c8d5d98389187a2f3966b4c38eaf

                                                                                                            SHA256

                                                                                                            fc51c1d409d5facdc38f60bcc0db51b68e40adec7efb908d6f8d11799de91896

                                                                                                            SHA512

                                                                                                            00ea226b62126048a3c6c200baa39063ccc972689dd9ee8cea9fa6978dd7f7872d706a4b209458c9a931d8f45b9e5d4ae5b3e8bafe80ce401f5d4c3f41e9f008

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5c4a76a75d54b7612f0dea0e2c9f1c3b

                                                                                                            SHA1

                                                                                                            b1c1d4d81de1875b4774ba63e8bb6c96ccb46780

                                                                                                            SHA256

                                                                                                            4b569a06f8e0f13c2d34d9cfe352b75700c1619fbe27ac90b56b0b399fcb22f7

                                                                                                            SHA512

                                                                                                            8b6fcddae4ced44c1b8896b4a7f21c3e20eeb6f2d28adee745052fba1684313dd9e51304dd17efeb20011016765f351e1d6bad01230574c194d2180c78471fd3

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5c4a76a75d54b7612f0dea0e2c9f1c3b

                                                                                                            SHA1

                                                                                                            b1c1d4d81de1875b4774ba63e8bb6c96ccb46780

                                                                                                            SHA256

                                                                                                            4b569a06f8e0f13c2d34d9cfe352b75700c1619fbe27ac90b56b0b399fcb22f7

                                                                                                            SHA512

                                                                                                            8b6fcddae4ced44c1b8896b4a7f21c3e20eeb6f2d28adee745052fba1684313dd9e51304dd17efeb20011016765f351e1d6bad01230574c194d2180c78471fd3

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c6c63d520ed354300f460e7b35225f0e

                                                                                                            SHA1

                                                                                                            aff72e0c55ebdaccd8b4ba304770b43248f57984

                                                                                                            SHA256

                                                                                                            35d99710ee8169bcd6eabf18ece7a09d9833065eee0dfd996d49e7d3e8b84791

                                                                                                            SHA512

                                                                                                            b25ef7aa82f23bb9d24d94797ef44488424d389101198ef1cea8613eaa3bd3334243d016460abe9825142183d219a60436c223de639c4fe8bbcdbddc77db89a2

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            c6c63d520ed354300f460e7b35225f0e

                                                                                                            SHA1

                                                                                                            aff72e0c55ebdaccd8b4ba304770b43248f57984

                                                                                                            SHA256

                                                                                                            35d99710ee8169bcd6eabf18ece7a09d9833065eee0dfd996d49e7d3e8b84791

                                                                                                            SHA512

                                                                                                            b25ef7aa82f23bb9d24d94797ef44488424d389101198ef1cea8613eaa3bd3334243d016460abe9825142183d219a60436c223de639c4fe8bbcdbddc77db89a2

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            2ac4c35f764b6d0ffa40a948734831ef

                                                                                                            SHA1

                                                                                                            745f765abf41925e22eef6cb8619d3632bae1750

                                                                                                            SHA256

                                                                                                            23f7dc8d7ec07542f8e7c606d317e5e2c300d36a955a97396dc54b1854efaf11

                                                                                                            SHA512

                                                                                                            1ec1e94a146b72a0f992fb9a2cd3e275ebbdad9e5d888545bfa6c2364fc9b9d981670bbe9a8bccd1294c3375d925014f05e23642e1c548eb1eb96abcc791ae69

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            2ac4c35f764b6d0ffa40a948734831ef

                                                                                                            SHA1

                                                                                                            745f765abf41925e22eef6cb8619d3632bae1750

                                                                                                            SHA256

                                                                                                            23f7dc8d7ec07542f8e7c606d317e5e2c300d36a955a97396dc54b1854efaf11

                                                                                                            SHA512

                                                                                                            1ec1e94a146b72a0f992fb9a2cd3e275ebbdad9e5d888545bfa6c2364fc9b9d981670bbe9a8bccd1294c3375d925014f05e23642e1c548eb1eb96abcc791ae69

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5899db2fbea4fe9f2e45dcd6b854662f

                                                                                                            SHA1

                                                                                                            4c6ec309da912d25797521cb48b2d15ac565cc4f

                                                                                                            SHA256

                                                                                                            d27dc1c3b1043b6029929b3b8fb016e7d0f40e9858e7a8debf3c864e1d235b38

                                                                                                            SHA512

                                                                                                            df7da4fdd2827a5db2f29231dcf20164a24075c72bfa36a295aca6e2f5bfc61cbacc53ade1520d5f51a3b47eabc6e6a8d4026522cbaf130139ecea793e13cf5d

                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            5899db2fbea4fe9f2e45dcd6b854662f

                                                                                                            SHA1

                                                                                                            4c6ec309da912d25797521cb48b2d15ac565cc4f

                                                                                                            SHA256

                                                                                                            d27dc1c3b1043b6029929b3b8fb016e7d0f40e9858e7a8debf3c864e1d235b38

                                                                                                            SHA512

                                                                                                            df7da4fdd2827a5db2f29231dcf20164a24075c72bfa36a295aca6e2f5bfc61cbacc53ade1520d5f51a3b47eabc6e6a8d4026522cbaf130139ecea793e13cf5d

                                                                                                          • C:\Program Files\Common Files\microsoft shared\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            edad129d222891bde093d222913596e9

                                                                                                            SHA1

                                                                                                            62f034c931e99f824903d1c81073268312aa44f1

                                                                                                            SHA256

                                                                                                            38fe19b07272f7239c23630e3483dfa4c4e535fe260ac12551f421451fc70f83

                                                                                                            SHA512

                                                                                                            7328782575d49d07f0a00fdbf1a31764886e88c9a8456cde3b4db566ba014c3e48609ef56e742b67ba7e44db6648da1d3d8efabeb8b55b5cba0762f550ae088b

                                                                                                          • C:\Program Files\Common Files\microsoft shared\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            edad129d222891bde093d222913596e9

                                                                                                            SHA1

                                                                                                            62f034c931e99f824903d1c81073268312aa44f1

                                                                                                            SHA256

                                                                                                            38fe19b07272f7239c23630e3483dfa4c4e535fe260ac12551f421451fc70f83

                                                                                                            SHA512

                                                                                                            7328782575d49d07f0a00fdbf1a31764886e88c9a8456cde3b4db566ba014c3e48609ef56e742b67ba7e44db6648da1d3d8efabeb8b55b5cba0762f550ae088b

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            13df5592ade91f1d9c1db56f4715f85b

                                                                                                            SHA1

                                                                                                            b58813266fd3b383799422d54e68227dbf88e640

                                                                                                            SHA256

                                                                                                            1343441676da85f5cfff3f07a66824b6aa6e482563582c936d9c91216a1732f2

                                                                                                            SHA512

                                                                                                            a7155945abb0b4f68c7e56ad6ec97f26c2ab1b2a81e167c75ebd1a5c533d277a423f453e6949aba03c8f0c503387364b6f2b533253964c616a7e0abd5b2fbcce

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            13df5592ade91f1d9c1db56f4715f85b

                                                                                                            SHA1

                                                                                                            b58813266fd3b383799422d54e68227dbf88e640

                                                                                                            SHA256

                                                                                                            1343441676da85f5cfff3f07a66824b6aa6e482563582c936d9c91216a1732f2

                                                                                                            SHA512

                                                                                                            a7155945abb0b4f68c7e56ad6ec97f26c2ab1b2a81e167c75ebd1a5c533d277a423f453e6949aba03c8f0c503387364b6f2b533253964c616a7e0abd5b2fbcce

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a10ace24b94f6a8a51c46d021fceb10e

                                                                                                            SHA1

                                                                                                            b85c73f31a59e5b2c62179b90e7568b34a6672e9

                                                                                                            SHA256

                                                                                                            057ac2facf41988bbd6e908b8b7ef3bbcc780bbc2a60052d2f4dd5d40c4e9a15

                                                                                                            SHA512

                                                                                                            c1565747b04cbaaf801c83f60ee0cbed2d5985e4bb8a08c4b0811d3e13d06744af103dae32e59da298666da00d46c5f3d0f1e7dc46c2b80483d39475c4e1ac2b

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            a10ace24b94f6a8a51c46d021fceb10e

                                                                                                            SHA1

                                                                                                            b85c73f31a59e5b2c62179b90e7568b34a6672e9

                                                                                                            SHA256

                                                                                                            057ac2facf41988bbd6e908b8b7ef3bbcc780bbc2a60052d2f4dd5d40c4e9a15

                                                                                                            SHA512

                                                                                                            c1565747b04cbaaf801c83f60ee0cbed2d5985e4bb8a08c4b0811d3e13d06744af103dae32e59da298666da00d46c5f3d0f1e7dc46c2b80483d39475c4e1ac2b

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            058eef97c8b7a7ef6987d7a747f5dc69

                                                                                                            SHA1

                                                                                                            c08eb2522c217a9e6110c86ceb42c32852be3d98

                                                                                                            SHA256

                                                                                                            05fe4cbc0e7e986b74e2d9bb2ca138c93745f8490c4f9558297774c5c567b072

                                                                                                            SHA512

                                                                                                            4904a10eebecedbbd6f8886a4d1f5cdd1ce31cdee997b573d4a8b551ad76158afc9fb21ec2cc441ccbb4167d0608550ee7dd970e06e5f81a515cbcbf3cfeebe7

                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            058eef97c8b7a7ef6987d7a747f5dc69

                                                                                                            SHA1

                                                                                                            c08eb2522c217a9e6110c86ceb42c32852be3d98

                                                                                                            SHA256

                                                                                                            05fe4cbc0e7e986b74e2d9bb2ca138c93745f8490c4f9558297774c5c567b072

                                                                                                            SHA512

                                                                                                            4904a10eebecedbbd6f8886a4d1f5cdd1ce31cdee997b573d4a8b551ad76158afc9fb21ec2cc441ccbb4167d0608550ee7dd970e06e5f81a515cbcbf3cfeebe7

                                                                                                          • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9b0f39b5aba61a72acdb0aa626305be3

                                                                                                            SHA1

                                                                                                            a2e59f769dc62f7913604a2e6eab619ff4eb6518

                                                                                                            SHA256

                                                                                                            eb8a158fee6795d27269bacdd8490a9c3d5a5b7119432aac63736a18ff78ef83

                                                                                                            SHA512

                                                                                                            050dd0ce40a9296b4327997444acc74c49415f33d3011bde814f6020f0bc5412ed2b48881d14294210c88b712a5fe3aa86b515214dbdd73609a47f703eaceecf

                                                                                                          • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            9b0f39b5aba61a72acdb0aa626305be3

                                                                                                            SHA1

                                                                                                            a2e59f769dc62f7913604a2e6eab619ff4eb6518

                                                                                                            SHA256

                                                                                                            eb8a158fee6795d27269bacdd8490a9c3d5a5b7119432aac63736a18ff78ef83

                                                                                                            SHA512

                                                                                                            050dd0ce40a9296b4327997444acc74c49415f33d3011bde814f6020f0bc5412ed2b48881d14294210c88b712a5fe3aa86b515214dbdd73609a47f703eaceecf

                                                                                                          • C:\Program Files\Google\Chrome\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            0dcd5abe50cf2cd1ba15f212897fc5c5

                                                                                                            SHA1

                                                                                                            4de7c581909603cd2815799a14415cf34b8cac90

                                                                                                            SHA256

                                                                                                            605a5df82e757dc79b4bdcba0634df1590f89c2c0397b3073b811c6325623fed

                                                                                                            SHA512

                                                                                                            2530a80cf49ebbaa7a8770fd5857260704b414042a60a93c7385e32e83f371bd4b22e9f5ed03867dc3d5af4e2190f782aee3f93b318abcaf77ffc6e043b86a8d

                                                                                                          • C:\Program Files\Google\Chrome\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            0dcd5abe50cf2cd1ba15f212897fc5c5

                                                                                                            SHA1

                                                                                                            4de7c581909603cd2815799a14415cf34b8cac90

                                                                                                            SHA256

                                                                                                            605a5df82e757dc79b4bdcba0634df1590f89c2c0397b3073b811c6325623fed

                                                                                                            SHA512

                                                                                                            2530a80cf49ebbaa7a8770fd5857260704b414042a60a93c7385e32e83f371bd4b22e9f5ed03867dc3d5af4e2190f782aee3f93b318abcaf77ffc6e043b86a8d

                                                                                                          • C:\Program Files\Google\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            b13aab618a5fcacad5c650cf074c39d0

                                                                                                            SHA1

                                                                                                            567927fc8749acfabde8fa91618403a58a536ca8

                                                                                                            SHA256

                                                                                                            8f9bf5c574f46b532a96eb10ca4e9d8d7ada123c6c3d11c3b9a49cfb3ece7fec

                                                                                                            SHA512

                                                                                                            d9ee4637b1a3309262b73bf5017eb7fea53a38fb757721e02747b4a9c62f6d6b0a839b860583c2c74729cec23ee1ba0fecaa43e805dab5e890152f2f411c8bc2

                                                                                                          • C:\Program Files\Google\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            b13aab618a5fcacad5c650cf074c39d0

                                                                                                            SHA1

                                                                                                            567927fc8749acfabde8fa91618403a58a536ca8

                                                                                                            SHA256

                                                                                                            8f9bf5c574f46b532a96eb10ca4e9d8d7ada123c6c3d11c3b9a49cfb3ece7fec

                                                                                                            SHA512

                                                                                                            d9ee4637b1a3309262b73bf5017eb7fea53a38fb757721e02747b4a9c62f6d6b0a839b860583c2c74729cec23ee1ba0fecaa43e805dab5e890152f2f411c8bc2

                                                                                                          • C:\Program Files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            11d46e1386e8e8a79406d158969e1e75

                                                                                                            SHA1

                                                                                                            2c7a4963c5c57e2ed497e79e47516f49b04bdbf4

                                                                                                            SHA256

                                                                                                            65e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209

                                                                                                            SHA512

                                                                                                            a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2

                                                                                                          • C:\Program Files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            11d46e1386e8e8a79406d158969e1e75

                                                                                                            SHA1

                                                                                                            2c7a4963c5c57e2ed497e79e47516f49b04bdbf4

                                                                                                            SHA256

                                                                                                            65e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209

                                                                                                            SHA512

                                                                                                            a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1245620864\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            f07415d0356ce6a05ec73991919bb427

                                                                                                            SHA1

                                                                                                            686ac8abfa8cc00b25976c1f62527c5259ecc604

                                                                                                            SHA256

                                                                                                            58d9fff2466c8d563f59ff43e62ba5cf621167c8ac3cb2940738997f1ff37989

                                                                                                            SHA512

                                                                                                            271f61d7e8045650feb9ec49f62d34dff74a693c6007a191f648969ae07081775234eb2f8271202bd1cf26beba3ba7b36aa63a598f8dad7331e12b1b467e0974

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\1245620864\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            f07415d0356ce6a05ec73991919bb427

                                                                                                            SHA1

                                                                                                            686ac8abfa8cc00b25976c1f62527c5259ecc604

                                                                                                            SHA256

                                                                                                            58d9fff2466c8d563f59ff43e62ba5cf621167c8ac3cb2940738997f1ff37989

                                                                                                            SHA512

                                                                                                            271f61d7e8045650feb9ec49f62d34dff74a693c6007a191f648969ae07081775234eb2f8271202bd1cf26beba3ba7b36aa63a598f8dad7331e12b1b467e0974

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            516c418a8074d80ff80060dec5d177a8

                                                                                                            SHA1

                                                                                                            5b9c7c589220b784d004c443e608403acd14ac73

                                                                                                            SHA256

                                                                                                            7ccb69d62cf0259b7ad505e7c81b2564d7f51a1d0558fbaecb4329de16214e40

                                                                                                            SHA512

                                                                                                            8be0817f551bc6ea176eaa783c62e982e9e43aaffe40e241e52930c0aef52b83a9bb620fe4866d1953fa55d6f0f510d93e11cd189839bc9f37bca955047d3387

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            efd61ff0ee43463b867b1b3855e26af1

                                                                                                            SHA1

                                                                                                            8bd56501716bbb99f7d11dfc1f50126b8fb5c150

                                                                                                            SHA256

                                                                                                            5623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e

                                                                                                            SHA512

                                                                                                            a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61

                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            efd61ff0ee43463b867b1b3855e26af1

                                                                                                            SHA1

                                                                                                            8bd56501716bbb99f7d11dfc1f50126b8fb5c150

                                                                                                            SHA256

                                                                                                            5623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e

                                                                                                            SHA512

                                                                                                            a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61

                                                                                                          • C:\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            414d8ce1afe6582f0087d6e1bc1d2bf7

                                                                                                            SHA1

                                                                                                            d9a251c68a7e0e31a4220e4da919bb5d48e0d51d

                                                                                                            SHA256

                                                                                                            02e5f96ff4caa6218466d2966ab89b34723cba674d8c6e6bea52ba04b23e54a2

                                                                                                            SHA512

                                                                                                            18ca3f6c80dc898447dec848fc2e2f68fd18116986794a3f490c007dc56301c43b66cdba21806676e4e9cd7a79d0bde158ee3610def11b8f277c121167f9c415

                                                                                                          • C:\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            414d8ce1afe6582f0087d6e1bc1d2bf7

                                                                                                            SHA1

                                                                                                            d9a251c68a7e0e31a4220e4da919bb5d48e0d51d

                                                                                                            SHA256

                                                                                                            02e5f96ff4caa6218466d2966ab89b34723cba674d8c6e6bea52ba04b23e54a2

                                                                                                            SHA512

                                                                                                            18ca3f6c80dc898447dec848fc2e2f68fd18116986794a3f490c007dc56301c43b66cdba21806676e4e9cd7a79d0bde158ee3610def11b8f277c121167f9c415

                                                                                                          • C:\odt\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            11d46e1386e8e8a79406d158969e1e75

                                                                                                            SHA1

                                                                                                            2c7a4963c5c57e2ed497e79e47516f49b04bdbf4

                                                                                                            SHA256

                                                                                                            65e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209

                                                                                                            SHA512

                                                                                                            a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2

                                                                                                          • C:\odt\backup.exe

                                                                                                            Filesize

                                                                                                            72KB

                                                                                                            MD5

                                                                                                            11d46e1386e8e8a79406d158969e1e75

                                                                                                            SHA1

                                                                                                            2c7a4963c5c57e2ed497e79e47516f49b04bdbf4

                                                                                                            SHA256

                                                                                                            65e25d1463c9d07da62c21b79722b5cc545c5d6a4aae2cdfd5a2cf42dd75c209

                                                                                                            SHA512

                                                                                                            a5f7a4c8eaff753c2f9d5b49bded1628bcd392782c357d8acfddb77919db8240bdbdb84558cd055e17ce8b2a2eccea8e1f2308d7c7a9016021acd2bc09c526c2