Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    205s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 16:42

General

  • Target

    d06118117357fd069a0510259a7c36a9adba6bc26de7d97bc78065139ffdf9d8.exe

  • Size

    72KB

  • MD5

    035caddfe7126cc000b216ab6ef43573

  • SHA1

    ce4231367a83666fee1daa1cb1ffb96a00dd2341

  • SHA256

    d06118117357fd069a0510259a7c36a9adba6bc26de7d97bc78065139ffdf9d8

  • SHA512

    a33fb786c38622326ccc019d5a8a47b462c021c86bc2955b5575af8e31ae9b067d6c2ab31300a7d229555d0cb705dcfeaff849f9d996467abd957cd9c8a5cc73

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2l:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPx

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d06118117357fd069a0510259a7c36a9adba6bc26de7d97bc78065139ffdf9d8.exe
    "C:\Users\Admin\AppData\Local\Temp\d06118117357fd069a0510259a7c36a9adba6bc26de7d97bc78065139ffdf9d8.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4868
    • C:\Users\Admin\AppData\Local\Temp\2576044659\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2576044659\backup.exe C:\Users\Admin\AppData\Local\Temp\2576044659\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3408
      • C:\data.exe
        \data.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4604
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:644
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:3916
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3468
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4660
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:100
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5096
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4080
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:2636
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4192
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:3876
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2784
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3456
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1540
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1052
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:376
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1708
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3472
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4412
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2092
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4648
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3404
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:1604
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:3748
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:4424
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Drops file in Program Files directory
                  PID:1700
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                      PID:2848
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                      9⤵
                        PID:4728
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                        9⤵
                        • Disables RegEdit via registry modification
                        PID:740
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                        9⤵
                          PID:3856
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                          9⤵
                            PID:3456
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\System Restore.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                            9⤵
                              PID:704
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                              9⤵
                                PID:748
                              • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                                9⤵
                                  PID:4532
                                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                                  9⤵
                                    PID:4188
                                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\System Restore.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\
                                    9⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:4280
                                • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                                  8⤵
                                    PID:2292
                                  • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                                    8⤵
                                      PID:996
                                    • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                                      8⤵
                                        PID:4936
                                      • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                                        "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                                        8⤵
                                          PID:3664
                                        • C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:1224
                                        • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          PID:812
                                        • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                                          8⤵
                                            PID:2312
                                          • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:176
                                          • C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lt-LT\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4152
                                          • C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe
                                            "C:\Program Files\Common Files\microsoft shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\lv-LV\
                                            8⤵
                                              PID:2552
                                            • C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe
                                              "C:\Program Files\Common Files\microsoft shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nb-NO\
                                              8⤵
                                                PID:1288
                                              • C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe
                                                "C:\Program Files\Common Files\microsoft shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\nl-NL\
                                                8⤵
                                                  PID:1600
                                                • C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe
                                                  "C:\Program Files\Common Files\microsoft shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pl-PL\
                                                  8⤵
                                                    PID:2192
                                                  • C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-BR\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:1008
                                                  • C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\pt-PT\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:3356
                                                  • C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe
                                                    "C:\Program Files\Common Files\microsoft shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ro-RO\
                                                    8⤵
                                                      PID:3720
                                                    • C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ru-RU\
                                                      8⤵
                                                      • Disables RegEdit via registry modification
                                                      • System policy modification
                                                      PID:3120
                                                    • C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe
                                                      "C:\Program Files\Common Files\microsoft shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sk-SK\
                                                      8⤵
                                                        PID:3824
                                                      • C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe
                                                        "C:\Program Files\Common Files\microsoft shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sl-SI\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        PID:3892
                                                      • C:\Program Files\Common Files\microsoft shared\ink\tr-TR\data.exe
                                                        "C:\Program Files\Common Files\microsoft shared\ink\tr-TR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\tr-TR\
                                                        8⤵
                                                          PID:3960
                                                        • C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe
                                                          "C:\Program Files\Common Files\microsoft shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\uk-UA\
                                                          8⤵
                                                            PID:432
                                                          • C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\th-TH\
                                                            8⤵
                                                              PID:4624
                                                            • C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\sv-SE\
                                                              8⤵
                                                              • System policy modification
                                                              PID:3512
                                                            • C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\System Restore.exe
                                                              "C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\
                                                              8⤵
                                                              • System policy modification
                                                              PID:1316
                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            • System policy modification
                                                            PID:1080
                                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                                              8⤵
                                                              • Disables RegEdit via registry modification
                                                              PID:1832
                                                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                                              8⤵
                                                                PID:2236
                                                              • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                                                "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                                                8⤵
                                                                  PID:2536
                                                                • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\System Restore.exe
                                                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                                                  8⤵
                                                                    PID:4048
                                                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                                                    8⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:3852
                                                                  • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                                                    8⤵
                                                                      PID:4396
                                                                  • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                    "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                                                    7⤵
                                                                      PID:3572
                                                                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                                                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                                                        8⤵
                                                                          PID:2308
                                                                      • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                                        "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                                                        7⤵
                                                                          PID:1312
                                                                        • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                                                                          "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:4740
                                                                        • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                                                                          "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                                                                          7⤵
                                                                            PID:1120
                                                                          • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                                                                            "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                                                                            7⤵
                                                                            • System policy modification
                                                                            PID:5076
                                                                        • C:\Program Files\Common Files\Services\backup.exe
                                                                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:2192
                                                                        • C:\Program Files\Common Files\System\backup.exe
                                                                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2072
                                                                          • C:\Program Files\Common Files\System\ado\backup.exe
                                                                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                                            7⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:3816
                                                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3308
                                                                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                                              8⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:4332
                                                                            • C:\Program Files\Common Files\System\ado\es-ES\update.exe
                                                                              "C:\Program Files\Common Files\System\ado\es-ES\update.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1748
                                                                            • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                                              "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4292
                                                                            • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                                              "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3776
                                                                            • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                              "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                              8⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:3104
                                                                          • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                            "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:5104
                                                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:3940
                                                                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:4952
                                                                          • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                            "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1512
                                                                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                            7⤵
                                                                              PID:208
                                                                            • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                              "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                              7⤵
                                                                                PID:3556
                                                                              • C:\Program Files\Common Files\System\msadc\System Restore.exe
                                                                                "C:\Program Files\Common Files\System\msadc\System Restore.exe" C:\Program Files\Common Files\System\msadc\
                                                                                7⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Drops file in Program Files directory
                                                                                PID:3580
                                                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                                                  8⤵
                                                                                    PID:1288
                                                                                  • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                                                    "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                                                    8⤵
                                                                                    • System policy modification
                                                                                    PID:4248
                                                                                  • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                                                    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                                                    8⤵
                                                                                    • System policy modification
                                                                                    PID:4220
                                                                                  • C:\Program Files\Common Files\System\msadc\fr-FR\data.exe
                                                                                    "C:\Program Files\Common Files\System\msadc\fr-FR\data.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                                                    8⤵
                                                                                      PID:2852
                                                                                    • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                                                      "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                                                      8⤵
                                                                                        PID:3512
                                                                                      • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                                                        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                                                        8⤵
                                                                                          PID:1008
                                                                                      • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                                        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                                        7⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        PID:3764
                                                                                        • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                                                          "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                                                          8⤵
                                                                                            PID:2748
                                                                                          • C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe
                                                                                            "C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                                                            8⤵
                                                                                              PID:4528
                                                                                            • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                                                              "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                                                              8⤵
                                                                                              • System policy modification
                                                                                              PID:4808
                                                                                            • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                                                              "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:1880
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\
                                                                                                9⤵
                                                                                                  PID:1468
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                  9⤵
                                                                                                    PID:4456
                                                                                                • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                                                  "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                                                  8⤵
                                                                                                    PID:432
                                                                                                  • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                                                    "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                                                    8⤵
                                                                                                      PID:2084
                                                                                              • C:\Program Files\Google\backup.exe
                                                                                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                                5⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:4296
                                                                                                • C:\Program Files\Google\Chrome\update.exe
                                                                                                  "C:\Program Files\Google\Chrome\update.exe" C:\Program Files\Google\Chrome\
                                                                                                  6⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Program Files directory
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:3588
                                                                                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                                    7⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:4084
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                                      8⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Drops file in Program Files directory
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:2400
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                                        9⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4976
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                                        9⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • System policy modification
                                                                                                        PID:2572
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                                        9⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:3532
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                                        9⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:4260
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                                        9⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2732
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                                        9⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:3184
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                                        9⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        PID:2104
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                        9⤵
                                                                                                        • System policy modification
                                                                                                        PID:3916
                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                          10⤵
                                                                                                            PID:552
                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                              11⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:1416
                                                                                                      • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                                        8⤵
                                                                                                        • Disables RegEdit via registry modification
                                                                                                        PID:2568
                                                                                                • C:\Program Files\Internet Explorer\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                                  5⤵
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:4860
                                                                                                  • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                    6⤵
                                                                                                      PID:3368
                                                                                                    • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                      6⤵
                                                                                                      • System policy modification
                                                                                                      PID:372
                                                                                                    • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                      6⤵
                                                                                                        PID:2780
                                                                                                      • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                        6⤵
                                                                                                          PID:840
                                                                                                        • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                          "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                          6⤵
                                                                                                            PID:1052
                                                                                                          • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                            "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                            6⤵
                                                                                                              PID:3980
                                                                                                            • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                              "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                              6⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:2560
                                                                                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                              6⤵
                                                                                                                PID:2304
                                                                                                                • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\System Restore.exe
                                                                                                                  "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\System Restore.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\
                                                                                                                  7⤵
                                                                                                                    PID:2612
                                                                                                                    • C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe
                                                                                                                      "C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\FilesInUse\B11EF506-7DE1-455F-8E20-67264DD4AF60\
                                                                                                                      8⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:4352
                                                                                                              • C:\Program Files\Java\backup.exe
                                                                                                                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                                5⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                PID:3292
                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                                                                  6⤵
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  PID:3952
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                                                                    7⤵
                                                                                                                    • System policy modification
                                                                                                                    PID:4880
                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                                                                    7⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:4756
                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                                                                      8⤵
                                                                                                                        PID:2200
                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                                                                        8⤵
                                                                                                                        • System policy modification
                                                                                                                        PID:1356
                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                                                                      7⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:2736
                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                                                                                        8⤵
                                                                                                                          PID:4192
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                                                                                            9⤵
                                                                                                                            • System policy modification
                                                                                                                            PID:4336
                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                                                                                        7⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • Drops file in Program Files directory
                                                                                                                        PID:2672
                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe
                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\
                                                                                                                          8⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:3608
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\System Restore.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\dtplugin\
                                                                                                                            9⤵
                                                                                                                              PID:692
                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\data.exe
                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\data.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\plugin2\
                                                                                                                              9⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              PID:4280
                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe
                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\
                                                                                                                              9⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              PID:4936
                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe
                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\jre\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\
                                                                                                                            8⤵
                                                                                                                            • Drops file in Program Files directory
                                                                                                                            PID:2036
                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe
                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\
                                                                                                                              9⤵
                                                                                                                                PID:3580
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\System Restore.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\applet\
                                                                                                                                9⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • System policy modification
                                                                                                                                PID:1596
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\
                                                                                                                                9⤵
                                                                                                                                • System policy modification
                                                                                                                                PID:4276
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\
                                                                                                                                9⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                PID:4864
                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe
                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\
                                                                                                                                9⤵
                                                                                                                                  PID:1864
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\backup.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\
                                                                                                                                  9⤵
                                                                                                                                    PID:3540
                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe
                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\
                                                                                                                                    9⤵
                                                                                                                                      PID:3356
                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe
                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\
                                                                                                                                        10⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:1396
                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\backup.exe
                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\jfr\
                                                                                                                                      9⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:1872
                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\backup.exe
                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\
                                                                                                                                      9⤵
                                                                                                                                      • System policy modification
                                                                                                                                      PID:3708
                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\backup.exe
                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\
                                                                                                                                      9⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:4748
                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe
                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\
                                                                                                                                  7⤵
                                                                                                                                    PID:952
                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe
                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\
                                                                                                                                      8⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      PID:1420
                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe
                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\
                                                                                                                                        9⤵
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:3340
                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe
                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\
                                                                                                                                          10⤵
                                                                                                                                            PID:4272
                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe
                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\
                                                                                                                                            10⤵
                                                                                                                                            • System policy modification
                                                                                                                                            PID:4464
                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe
                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\
                                                                                                                                          9⤵
                                                                                                                                            PID:3916
                                                                                                                                          • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe
                                                                                                                                            "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\
                                                                                                                                            9⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                            PID:2668
                                                                                                                                            • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe
                                                                                                                                              "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.console_5.5.0.165303\
                                                                                                                                              10⤵
                                                                                                                                                PID:5104
                                                                                                                                              • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\System Restore.exe
                                                                                                                                                "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\System Restore.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\
                                                                                                                                                10⤵
                                                                                                                                                  PID:3532
                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe
                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\
                                                                                                                                                  10⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:760
                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe
                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\
                                                                                                                                                  10⤵
                                                                                                                                                    PID:3376
                                                                                                                                                  • C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\
                                                                                                                                                    10⤵
                                                                                                                                                      PID:4780
                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\backup.exe
                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\
                                                                                                                                                  8⤵
                                                                                                                                                    PID:1760
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\etc\
                                                                                                                                                      9⤵
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:2416
                                                                                                                                                    • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\
                                                                                                                                                      9⤵
                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                      PID:3944
                                                                                                                                                      • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\backup.exe
                                                                                                                                                        "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\
                                                                                                                                                        10⤵
                                                                                                                                                          PID:2104
                                                                                                                                                        • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\backup.exe
                                                                                                                                                          "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\
                                                                                                                                                          10⤵
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          PID:4744
                                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                                    7⤵
                                                                                                                                                      PID:1056
                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                                                                                                                    6⤵
                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                    PID:4572
                                                                                                                                                    • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                                                                                                                      "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                                                                                                                      7⤵
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      PID:4484
                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\data.exe
                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\data.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                                                                                                        8⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        PID:1396
                                                                                                                                                      • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                                                                                                        "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                                                                                                        8⤵
                                                                                                                                                          PID:1364
                                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe
                                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\bin\server\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\server\
                                                                                                                                                          8⤵
                                                                                                                                                            PID:3596
                                                                                                                                                        • C:\Program Files\Java\jre1.8.0_66\lib\backup.exe
                                                                                                                                                          "C:\Program Files\Java\jre1.8.0_66\lib\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\
                                                                                                                                                          7⤵
                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                          PID:3912
                                                                                                                                                          • C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe
                                                                                                                                                            "C:\Program Files\Java\jre1.8.0_66\lib\amd64\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\amd64\
                                                                                                                                                            8⤵
                                                                                                                                                              PID:3704
                                                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\applet\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\applet\
                                                                                                                                                              8⤵
                                                                                                                                                              • System policy modification
                                                                                                                                                              PID:3688
                                                                                                                                                            • C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe
                                                                                                                                                              "C:\Program Files\Java\jre1.8.0_66\lib\cmm\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\cmm\
                                                                                                                                                              8⤵
                                                                                                                                                                PID:644
                                                                                                                                                              • C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe
                                                                                                                                                                "C:\Program Files\Java\jre1.8.0_66\lib\fonts\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\fonts\
                                                                                                                                                                8⤵
                                                                                                                                                                  PID:4592
                                                                                                                                                                • C:\Program Files\Java\jre1.8.0_66\lib\ext\backup.exe
                                                                                                                                                                  "C:\Program Files\Java\jre1.8.0_66\lib\ext\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\ext\
                                                                                                                                                                  8⤵
                                                                                                                                                                    PID:1960
                                                                                                                                                                  • C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe
                                                                                                                                                                    "C:\Program Files\Java\jre1.8.0_66\lib\deploy\backup.exe" C:\Program Files\Java\jre1.8.0_66\lib\deploy\
                                                                                                                                                                    8⤵
                                                                                                                                                                      PID:4360
                                                                                                                                                              • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                                                                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:2432
                                                                                                                                                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                                                                                                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                                                                                                                    6⤵
                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                    PID:2900
                                                                                                                                                                  • C:\Program Files\Microsoft Office\PackageManifests\update.exe
                                                                                                                                                                    "C:\Program Files\Microsoft Office\PackageManifests\update.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:3472
                                                                                                                                                                    • C:\Program Files\Microsoft Office\root\backup.exe
                                                                                                                                                                      "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                                                                                                                      6⤵
                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                      PID:3904
                                                                                                                                                                      • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                                                                                                                        "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                        PID:1492
                                                                                                                                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                                                                                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                                                                                                                        7⤵
                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                        PID:2676
                                                                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                                                                                                                          8⤵
                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                          PID:1588
                                                                                                                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                                                                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                                                                                                                          8⤵
                                                                                                                                                                            PID:5056
                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\System Restore.exe
                                                                                                                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\System Restore.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\
                                                                                                                                                                            8⤵
                                                                                                                                                                            • System policy modification
                                                                                                                                                                            PID:4752
                                                                                                                                                                        • C:\Program Files\Microsoft Office\root\fre\backup.exe
                                                                                                                                                                          "C:\Program Files\Microsoft Office\root\fre\backup.exe" C:\Program Files\Microsoft Office\root\fre\
                                                                                                                                                                          7⤵
                                                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                                                          • System policy modification
                                                                                                                                                                          PID:3760
                                                                                                                                                                        • C:\Program Files\Microsoft Office\root\Integration\backup.exe
                                                                                                                                                                          "C:\Program Files\Microsoft Office\root\Integration\backup.exe" C:\Program Files\Microsoft Office\root\Integration\
                                                                                                                                                                          7⤵
                                                                                                                                                                            PID:1596
                                                                                                                                                                            • C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe
                                                                                                                                                                              "C:\Program Files\Microsoft Office\root\Integration\Addons\backup.exe" C:\Program Files\Microsoft Office\root\Integration\Addons\
                                                                                                                                                                              8⤵
                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                              PID:3104
                                                                                                                                                                          • C:\Program Files\Microsoft Office\root\Licenses\backup.exe
                                                                                                                                                                            "C:\Program Files\Microsoft Office\root\Licenses\backup.exe" C:\Program Files\Microsoft Office\root\Licenses\
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:2312
                                                                                                                                                                            • C:\Program Files\Microsoft Office\root\loc\backup.exe
                                                                                                                                                                              "C:\Program Files\Microsoft Office\root\loc\backup.exe" C:\Program Files\Microsoft Office\root\loc\
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:1236
                                                                                                                                                                              • C:\Program Files\Microsoft Office\root\Office15\backup.exe
                                                                                                                                                                                "C:\Program Files\Microsoft Office\root\Office15\backup.exe" C:\Program Files\Microsoft Office\root\Office15\
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:60
                                                                                                                                                                                • C:\Program Files\Microsoft Office\root\Licenses16\backup.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office\root\Licenses16\backup.exe" C:\Program Files\Microsoft Office\root\Licenses16\
                                                                                                                                                                                  7⤵
                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                  PID:4460
                                                                                                                                                                              • C:\Program Files\Microsoft Office\Updates\backup.exe
                                                                                                                                                                                "C:\Program Files\Microsoft Office\Updates\backup.exe" C:\Program Files\Microsoft Office\Updates\
                                                                                                                                                                                6⤵
                                                                                                                                                                                  PID:4184
                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Updates\Download\backup.exe
                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Updates\Download\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:1508
                                                                                                                                                                                    • C:\Program Files\Microsoft Office\Updates\Apply\backup.exe
                                                                                                                                                                                      "C:\Program Files\Microsoft Office\Updates\Apply\backup.exe" C:\Program Files\Microsoft Office\Updates\Apply\
                                                                                                                                                                                      7⤵
                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                      PID:2304
                                                                                                                                                                                • C:\Program Files\Microsoft Office 15\backup.exe
                                                                                                                                                                                  "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:1488
                                                                                                                                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                                                                                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      PID:4476
                                                                                                                                                                                  • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                                                                                    "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                    PID:3360
                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      PID:4032
                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:2200
                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        PID:1060
                                                                                                                                                                                • C:\Program Files (x86)\backup.exe
                                                                                                                                                                                  "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                                                                                  4⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                  PID:5028
                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\update.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
                                                                                                                                                                                    5⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                    PID:3744
                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                      PID:4832
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        PID:2248
                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System Restore.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                                                                                                                                        7⤵
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:1800
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:2620
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4680
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:3088
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                                                                                                                            9⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                            PID:4964
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                          PID:3852
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:1368
                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                                                                                                                          8⤵
                                                                                                                                                                                            PID:216
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                              PID:4184
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:1272
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              PID:4608
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:4584
                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                                                                                                                            8⤵
                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                            PID:3716
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                                                                                                                              9⤵
                                                                                                                                                                                                PID:3920
                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                                                                                                                              8⤵
                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                              PID:1748
                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                                                                                                                                9⤵
                                                                                                                                                                                                  PID:3804
                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                                                                                                                                8⤵
                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                PID:4316
                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                                                                                                                                  9⤵
                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                  PID:3860
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                                                                                    10⤵
                                                                                                                                                                                                      PID:4680
                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                                                                                                                                                    9⤵
                                                                                                                                                                                                      PID:2904
                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                              PID:3316
                                                                                                                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                                                                                                                              11⤵
                                                                                                                                                                                                                PID:1880
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\System Restore.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                            PID:4784
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                                                                              10⤵
                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\
                                                                                                                                                                                                            9⤵
                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                            PID:1480
                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                            PID:3556
                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\
                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                PID:4744
                                                                                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\backup.exe
                                                                                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                • C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe
                                                                                                                                                                                                                  "C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\backup.exe" C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\
                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                    PID:4044
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                PID:1268
                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\
                                                                                                                                                                                                                8⤵
                                                                                                                                                                                                                  PID:4888
                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\System Restore.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\
                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                    PID:3524
                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\
                                                                                                                                                                                                                      9⤵
                                                                                                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                      PID:3316
                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\
                                                                                                                                                                                                                        10⤵
                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\
                                                                                                                                                                                                                            11⤵
                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                            PID:2856
                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\data.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\
                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                PID:4948
                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\
                                                                                                                                                                                                                                  13⤵
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  PID:2904
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\cef\
                                                                                                                                                                                                                                    14⤵
                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\app\dev\libs\
                                                                                                                                                                                                                                      14⤵
                                                                                                                                                                                                                                      • System policy modification
                                                                                                                                                                                                                                      PID:4940
                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\
                                                                                                                                                                                                                                  12⤵
                                                                                                                                                                                                                                    PID:1248
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\
                                                                                                                                                                                                                                      13⤵
                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\cef\
                                                                                                                                                                                                                                          14⤵
                                                                                                                                                                                                                                            PID:1468
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\dev\libs\
                                                                                                                                                                                                                                            14⤵
                                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\
                                                                                                                                                                                                                                          12⤵
                                                                                                                                                                                                                                            PID:2164
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\
                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                              PID:824
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\
                                                                                                                                                                                                                                          11⤵
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            PID:2828
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\
                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                              PID:4064
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\update.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\themes\dark\
                                                                                                                                                                                                                                                14⤵
                                                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                PID:1564
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\System Restore.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\
                                                                                                                                                                                                                                              13⤵
                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                              • System policy modification
                                                                                                                                                                                                                                              PID:4452
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\
                                                                                                                                                                                                                                            12⤵
                                                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\
                                                                                                                                                                                                                                              12⤵
                                                                                                                                                                                                                                                PID:4372
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                                                                                                                                                                      7⤵
                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                      PID:1652
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                                                                                                                                                                        8⤵
                                                                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                                                                        PID:1828
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                            PID:3968
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                                                                                                                                                                          8⤵
                                                                                                                                                                                                                                            PID:3244
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                                                                                                                                                                            8⤵
                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                                                                                                                                                              9⤵
                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                              PID:4296
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                                                                                                                                                                                10⤵
                                                                                                                                                                                                                                                  PID:4244
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                                                                                                                                                                  10⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                  PID:4892
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                                                                                                                                                                            7⤵
                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                                                                                                                                                                              8⤵
                                                                                                                                                                                                                                                PID:2320
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                          PID:1984
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                              PID:5000
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                PID:4360
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                                                                                                                                                                                7⤵
                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                                                                                                                                                                                  8⤵
                                                                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                                                                                                                                                                    8⤵
                                                                                                                                                                                                                                                      PID:656
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                                                                    PID:516
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                                                                                                                                                                      8⤵
                                                                                                                                                                                                                                                        PID:2184
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                                                                                                                                                                          9⤵
                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                          PID:5084
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                                                                                                                                                                        7⤵
                                                                                                                                                                                                                                                          PID:4988
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Google\System Restore.exe
                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Google\System Restore.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                        PID:4596
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              PID:2756
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                                                              PID:452
                                                                                                                                                                                                                                                        • C:\Users\backup.exe
                                                                                                                                                                                                                                                          C:\Users\backup.exe C:\Users\
                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                                                                          PID:4076
                                                                                                                                                                                                                                                          • C:\Users\Admin\backup.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                            PID:808
                                                                                                                                                                                                                                                            • C:\Users\Admin\3D Objects\update.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\3D Objects\update.exe" C:\Users\Admin\3D Objects\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                              PID:1960
                                                                                                                                                                                                                                                            • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                                              • C:\Users\Admin\Desktop\update.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\Desktop\update.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                                                                                                6⤵
                                                                                                                                                                                                                                                                  PID:1224
                                                                                                                                                                                                                                                                • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                  PID:2736
                                                                                                                                                                                                                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                                                                                  PID:692
                                                                                                                                                                                                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                    PID:1324
                                                                                                                                                                                                                                                                  • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                    PID:2232
                                                                                                                                                                                                                                                                  • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                      PID:2760
                                                                                                                                                                                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                                                                                        PID:4788
                                                                                                                                                                                                                                                                      • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                                                                                                        PID:3864
                                                                                                                                                                                                                                                                    • C:\Users\Public\backup.exe
                                                                                                                                                                                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                                                                                      5⤵
                                                                                                                                                                                                                                                                        PID:3552
                                                                                                                                                                                                                                                                        • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                                                                                          C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                                                                                            PID:4456
                                                                                                                                                                                                                                                                          • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            PID:4860
                                                                                                                                                                                                                                                                          • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            PID:4304
                                                                                                                                                                                                                                                                          • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                                                                                              PID:376
                                                                                                                                                                                                                                                                            • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                                                                                              C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                                                                                              6⤵
                                                                                                                                                                                                                                                                                PID:2244
                                                                                                                                                                                                                                                                          • C:\Windows\backup.exe
                                                                                                                                                                                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:2552
                                                                                                                                                                                                                                                                            • C:\Windows\addins\System Restore.exe
                                                                                                                                                                                                                                                                              "C:\Windows\addins\System Restore.exe" C:\Windows\addins\
                                                                                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                                                                                PID:748
                                                                                                                                                                                                                                                                              • C:\Windows\appcompat\update.exe
                                                                                                                                                                                                                                                                                C:\Windows\appcompat\update.exe C:\Windows\appcompat\
                                                                                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:1400
                                                                                                                                                                                                                                                                                • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                                                                                                                                                                  C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                                                                                                    PID:4756
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                    PID:1036
                                                                                                                                                                                                                                                                                  • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                                                                                                                                                                    C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:904
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:4912
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:4892
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:1284
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:1744
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:3000
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:3092
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:2860
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Google\Update\Download\backup.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Google\Update\Download\backup.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:5100
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\System Restore.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\libs\
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:2604
                                                                                                                                                                                                                                                                                  • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\B11EF506-7DE1-455F-8E20-67264DD4AF60\
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                        PID:4916
                                                                                                                                                                                                                                                                                      • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\update.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                          PID:2540
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:3396
                                                                                                                                                                                                                                                                                          • C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\backup.exe" C:\Program Files\Microsoft Office\Updates\Download\PackageFiles\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:4968
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            PID:100
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                                                                                                                            PID:3628
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                                                                                                                                                            PID:1864
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:1660

                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                                            • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              aa8e904056d85defb8592a229c04ed4f

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              2819ab2e9cf526afae649b386ba6b2b32474695c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              577433c3e00f92d5734230663b20a30ff0d19a77efc6cfdb387cf05c46593d64

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              b5bf80a14e354732e524940ae25e9e5e76efa36811593f95f652f95f46e287260b9172bdd8104b7282c81d8160101ab85f69a85f18795c37ded2ec8bc6f903a3

                                                                                                                                                                                                                                                                                            • C:\PerfLogs\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              aa8e904056d85defb8592a229c04ed4f

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              2819ab2e9cf526afae649b386ba6b2b32474695c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              577433c3e00f92d5734230663b20a30ff0d19a77efc6cfdb387cf05c46593d64

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              b5bf80a14e354732e524940ae25e9e5e76efa36811593f95f652f95f46e287260b9172bdd8104b7282c81d8160101ab85f69a85f18795c37ded2ec8bc6f903a3

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              93cd5e23066bb2dee587b2b97daa7d8e

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              051321d619d624577b8c82ff3f9bf0ea7aff7d50

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              173a7a42a5a0877b9f75181b57162f76616d827d7b761383703d23f2276011fa

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4c18c736b31d5a03f9249bff7fe7c3aae01b4a518999b6876f41072dcbab6440beec435f5895925a557e7432a77a5726aa47d713ce23b25b6dccde336418f6dd

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              93cd5e23066bb2dee587b2b97daa7d8e

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              051321d619d624577b8c82ff3f9bf0ea7aff7d50

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              173a7a42a5a0877b9f75181b57162f76616d827d7b761383703d23f2276011fa

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4c18c736b31d5a03f9249bff7fe7c3aae01b4a518999b6876f41072dcbab6440beec435f5895925a557e7432a77a5726aa47d713ce23b25b6dccde336418f6dd

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              6a6407541c3736bf6aadb80a3ab938e2

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              579d9835f18098e86805eb5fe9375e38138a9ee9

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              7a833a4b73f8c4f0d50892fd7c3bf3ac1de1f8c18bbd38f892c264c3e52f6839

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              8e73bb0c8e880c628ac19898bcbb69a0daab8df415f7981d5fa31f7df99353dc6b6b983c2b193162e4f566202f960644b8dc0f4a314f41abed4d7d3dd812fb09

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              6a6407541c3736bf6aadb80a3ab938e2

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              579d9835f18098e86805eb5fe9375e38138a9ee9

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              7a833a4b73f8c4f0d50892fd7c3bf3ac1de1f8c18bbd38f892c264c3e52f6839

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              8e73bb0c8e880c628ac19898bcbb69a0daab8df415f7981d5fa31f7df99353dc6b6b983c2b193162e4f566202f960644b8dc0f4a314f41abed4d7d3dd812fb09

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\update.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              14421afa13edc7ed8fa7cca47458511a

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              91dc429aed65ff54138fa81963cb34f6ef7fa821

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              2aadbe99107fa0703648d2a73d6ca68d97bc77e927746e8412b22b2cd8c347e1

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              d6dc9c76171cee8986064503aaa07df2f38b7a5cdb45f9d910ba3e4b66215107c03b8d3afe2bba16933a7a2669495df184517501cddbc31e7db95eb1a4d827c6

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Adobe\update.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              14421afa13edc7ed8fa7cca47458511a

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              91dc429aed65ff54138fa81963cb34f6ef7fa821

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              2aadbe99107fa0703648d2a73d6ca68d97bc77e927746e8412b22b2cd8c347e1

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              d6dc9c76171cee8986064503aaa07df2f38b7a5cdb45f9d910ba3e4b66215107c03b8d3afe2bba16933a7a2669495df184517501cddbc31e7db95eb1a4d827c6

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              cced6b31e4c2a4c4213b57f8e2419312

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              5c0cd1ed09cbacbe16addd70e7ba97ae7e783883

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              9b289a3251291ae1d7245a482e358a01281a380786e3d1ecd68651c4ab95db76

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              d7096060ca49f062431b49b27397617e1e89f30bef1e071fd48591780c629673f34b9a0288c5aadc74d5f2168acacb5cd4674fed2145f1bfe4e17fbbf43b6179

                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              cced6b31e4c2a4c4213b57f8e2419312

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              5c0cd1ed09cbacbe16addd70e7ba97ae7e783883

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              9b289a3251291ae1d7245a482e358a01281a380786e3d1ecd68651c4ab95db76

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              d7096060ca49f062431b49b27397617e1e89f30bef1e071fd48591780c629673f34b9a0288c5aadc74d5f2168acacb5cd4674fed2145f1bfe4e17fbbf43b6179

                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              a2877a0105ff4b42f3d3e2201a19892a

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              65981cf638cb1caca3610947643123c92e638b0f

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              3583548a230123ca72257375b2859b2e1de81556cd61e14c9681cac669ed06d0

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              31237b86786bf04b911a99443b7fb35c5478fce18ff7e46f4fdf81178f54454d995d3e84d3c290cac67dff7e2bb1f8e92cabb6557800f0e97cab24136277662d

                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              a2877a0105ff4b42f3d3e2201a19892a

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              65981cf638cb1caca3610947643123c92e638b0f

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              3583548a230123ca72257375b2859b2e1de81556cd61e14c9681cac669ed06d0

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              31237b86786bf04b911a99443b7fb35c5478fce18ff7e46f4fdf81178f54454d995d3e84d3c290cac67dff7e2bb1f8e92cabb6557800f0e97cab24136277662d

                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              7bd9ad198fd67920a610b13730bd6eaf

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              24d64b9ddbc41d1f52c22d3d6efe54c100cd9691

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              eced60aa0202d30792a79554bc86103e8255455a899319cde26144eb3f915341

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              d61f6159657642b49a56801d0fc938bdd7dec23f89b7ece3f68ddcc9149043cb7fbdc75df22b42e3c6ac1529c2002e8a8f94ef5efb6bb5b45a4d5342e8d492fc

                                                                                                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              7bd9ad198fd67920a610b13730bd6eaf

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              24d64b9ddbc41d1f52c22d3d6efe54c100cd9691

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              eced60aa0202d30792a79554bc86103e8255455a899319cde26144eb3f915341

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              d61f6159657642b49a56801d0fc938bdd7dec23f89b7ece3f68ddcc9149043cb7fbdc75df22b42e3c6ac1529c2002e8a8f94ef5efb6bb5b45a4d5342e8d492fc

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              bc0e0a4bb21592ab69a4ddf0b65e5510

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              d97bed4edb7c4f43f98b59f90fb11383a67258c7

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              8e032cb949da616486cdd1be657c66242663385578a7eaa74f9b60106951e28a

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              5d651c37d7f786436532df4f63a5147f88d330d1dc5d0bb4485f6c793c68637ef6450473b6246ed59397e915dac9f68128d5f00e986c582eb9be74b9561cadb1

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              bc0e0a4bb21592ab69a4ddf0b65e5510

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              d97bed4edb7c4f43f98b59f90fb11383a67258c7

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              8e032cb949da616486cdd1be657c66242663385578a7eaa74f9b60106951e28a

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              5d651c37d7f786436532df4f63a5147f88d330d1dc5d0bb4485f6c793c68637ef6450473b6246ed59397e915dac9f68128d5f00e986c582eb9be74b9561cadb1

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              735ee52248836171014671e7ab395785

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              1ad8ce4adc2a1ad3dc0a17db5d5277cca01e0f8d

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              cae4a7a72285654dd4cf9bf1348bf67a69b38120849254440764c26a4419366b

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              5a43bc5fc6386945cfc9a4c90ed1152a34f2662c90ad090a461df02070d986295d06907576da2fc6fe656c309408491199360f9385a0065e0c106ed4f3744dd2

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              735ee52248836171014671e7ab395785

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              1ad8ce4adc2a1ad3dc0a17db5d5277cca01e0f8d

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              cae4a7a72285654dd4cf9bf1348bf67a69b38120849254440764c26a4419366b

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              5a43bc5fc6386945cfc9a4c90ed1152a34f2662c90ad090a461df02070d986295d06907576da2fc6fe656c309408491199360f9385a0065e0c106ed4f3744dd2

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              0003c2f819f0a03ff0d7132cf2fc4c00

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              996b33466130e1dcc3e9f13de726e58a499a670c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              9c20390be0e7af5e221ec2c54c4c0b68f81a3e492032ece32f28f69935d4091c

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              3a90b9c83aeed8a9bd68fe9191c62d51282d0d2c9acb848a9036de23d6ee99005de334a0b2dc5510cd7f6cc32ee61532d965c88312c9075c6af0406747dfb2dd

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              0003c2f819f0a03ff0d7132cf2fc4c00

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              996b33466130e1dcc3e9f13de726e58a499a670c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              9c20390be0e7af5e221ec2c54c4c0b68f81a3e492032ece32f28f69935d4091c

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              3a90b9c83aeed8a9bd68fe9191c62d51282d0d2c9acb848a9036de23d6ee99005de334a0b2dc5510cd7f6cc32ee61532d965c88312c9075c6af0406747dfb2dd

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              60d8eca942d09c95961afdcccec4e62d

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              bb9335bd78b143df1f58e7c4d8efc9d6f8dca5a9

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              5258d86ca46e03a6016b55e8d71bfb0e616eb70dd70c7639553824aa170857da

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4a3734a6fc4a78027b6d7c7b34e058ccbd94dfefb6fa9a8d23d742a60068e6c436427f873d09d062169727bc4c6c1942fedee654d997741d0463ea462bd1ff3e

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              60d8eca942d09c95961afdcccec4e62d

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              bb9335bd78b143df1f58e7c4d8efc9d6f8dca5a9

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              5258d86ca46e03a6016b55e8d71bfb0e616eb70dd70c7639553824aa170857da

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4a3734a6fc4a78027b6d7c7b34e058ccbd94dfefb6fa9a8d23d742a60068e6c436427f873d09d062169727bc4c6c1942fedee654d997741d0463ea462bd1ff3e

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              bdbbb39b45674ddd9e612c77677d8b0e

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              9615e445374aea8df9ff3e1bbc74f13b4d409b0d

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              b66cd0895c5171e7ed59512586fefe9af017cd3f1efea563cb01aeabd1fd208b

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              afaed5a0055cfdabe0b023554e254a63f4e2a5083b9e074f84dccd1fb74a8de2d3c9d4826f2c70244dc02e03eb48770d28c05ea108a482f2bc69b912d77da4a9

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\System\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              bdbbb39b45674ddd9e612c77677d8b0e

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              9615e445374aea8df9ff3e1bbc74f13b4d409b0d

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              b66cd0895c5171e7ed59512586fefe9af017cd3f1efea563cb01aeabd1fd208b

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              afaed5a0055cfdabe0b023554e254a63f4e2a5083b9e074f84dccd1fb74a8de2d3c9d4826f2c70244dc02e03eb48770d28c05ea108a482f2bc69b912d77da4a9

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              7e4a3d0c16d9bafbdea626db4bdf7ad2

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              8b0998e88ad0df145663bade9a3d19b48fea55d1

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d450000c007f83721abf9e167fe144c8e63ed450c61a4b9699e28f62e676b2d4

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              dfc705f2af698b9fcc37b172c46451999e622ce49be85d49df9ef9c5014bbf9189dee3c5169100ec4d045f3b993aea6ae604834ac0eb324e71062b6843ca31ba

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              7e4a3d0c16d9bafbdea626db4bdf7ad2

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              8b0998e88ad0df145663bade9a3d19b48fea55d1

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d450000c007f83721abf9e167fe144c8e63ed450c61a4b9699e28f62e676b2d4

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              dfc705f2af698b9fcc37b172c46451999e622ce49be85d49df9ef9c5014bbf9189dee3c5169100ec4d045f3b993aea6ae604834ac0eb324e71062b6843ca31ba

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              9612cab04d752563af3701627e2eb57d

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              c2157fa6ca179ec3b777d1de37ab119f4a2defad

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              daedf49ac097d5db0e199594e03273d848b6f0ed02c93f2196da8f362eca9c7a

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              044e64a2d79897e13eade9f39ee7cfd4c47d556712ddf6d33da9f3ace4bc5d5f6fe670bb86c8267af31a1eb3ba0ecd8f73731d7cffa91f5f89c72eb2262ec81e

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ClickToRun\System Restore.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              9612cab04d752563af3701627e2eb57d

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              c2157fa6ca179ec3b777d1de37ab119f4a2defad

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              daedf49ac097d5db0e199594e03273d848b6f0ed02c93f2196da8f362eca9c7a

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              044e64a2d79897e13eade9f39ee7cfd4c47d556712ddf6d33da9f3ace4bc5d5f6fe670bb86c8267af31a1eb3ba0ecd8f73731d7cffa91f5f89c72eb2262ec81e

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              cf526480e8ed5541710bd1dc279a8d15

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              d9090d930ea4129c0073f4d31d24a6a0ce2fedc2

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              382438005e702fe42818c88f724403c7b0dcea3283562109a2472a80a48f1e9e

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              1840225f037cb53eabcf7acf59aca2ff4826db1db7c4b03460af025419618a3c68c3b78abfd0870fde3ecfaace68204d2d61968b2a90131a46ac0a0d2bfffc99

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              cf526480e8ed5541710bd1dc279a8d15

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              d9090d930ea4129c0073f4d31d24a6a0ce2fedc2

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              382438005e702fe42818c88f724403c7b0dcea3283562109a2472a80a48f1e9e

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              1840225f037cb53eabcf7acf59aca2ff4826db1db7c4b03460af025419618a3c68c3b78abfd0870fde3ecfaace68204d2d61968b2a90131a46ac0a0d2bfffc99

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              e6fc6b0b6ba74a5865032d6837842f38

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              14d57d9b2131f9487043ff6005922b141d04902a

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              14618385f5cdf0c22b9d427ef4814c5a6526db372e0adce80c2d5fcf731082b7

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              7474b540d7b3d9ee0493430dc72a0b80fe2305cd71c2980ddc601a051ba8aa5f5e70092b51a59763b43c79d34bfbd6ce17232c6b75a22262cb21e8ffcb9a6f2e

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              e6fc6b0b6ba74a5865032d6837842f38

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              14d57d9b2131f9487043ff6005922b141d04902a

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              14618385f5cdf0c22b9d427ef4814c5a6526db372e0adce80c2d5fcf731082b7

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              7474b540d7b3d9ee0493430dc72a0b80fe2305cd71c2980ddc601a051ba8aa5f5e70092b51a59763b43c79d34bfbd6ce17232c6b75a22262cb21e8ffcb9a6f2e

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              c4a7c18dbaa263551bd787b1a0a56f54

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              21e0b258606231d3a7b9b53a3b4aea94f83a526f

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              73dc094e55c85a91a090370a0cfe9708e2387930129d8e59a6490757a002b874

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              814d89a58cc8a4cc5b06ed307db7efaf32f8fcc7dc8d3ed42e797ec4accf2312f5d748918639fdd618c5d98570388f529070be3809fc0261f2d6936ff79c4375

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              c4a7c18dbaa263551bd787b1a0a56f54

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              21e0b258606231d3a7b9b53a3b4aea94f83a526f

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              73dc094e55c85a91a090370a0cfe9708e2387930129d8e59a6490757a002b874

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              814d89a58cc8a4cc5b06ed307db7efaf32f8fcc7dc8d3ed42e797ec4accf2312f5d748918639fdd618c5d98570388f529070be3809fc0261f2d6936ff79c4375

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              c2311b035531a4a7e536e91065a2eadd

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              a4bd875b22dc76ce59bfb34a410b774abe97ca92

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              fdf1df56dc0257e0af7a37231ca23fe65bb9f05eb99aca2f122a5c25aa0b4235

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              de0d8551b058559fd0db17ba794d212d4336193035c8466740280a0bbaf6f192ae22f7b5404fe3a8c1ac3169d65c55d1f6f29167e374a4a09158eeaa5f526ac5

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              c2311b035531a4a7e536e91065a2eadd

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              a4bd875b22dc76ce59bfb34a410b774abe97ca92

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              fdf1df56dc0257e0af7a37231ca23fe65bb9f05eb99aca2f122a5c25aa0b4235

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              de0d8551b058559fd0db17ba794d212d4336193035c8466740280a0bbaf6f192ae22f7b5404fe3a8c1ac3169d65c55d1f6f29167e374a4a09158eeaa5f526ac5

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              c2311b035531a4a7e536e91065a2eadd

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              a4bd875b22dc76ce59bfb34a410b774abe97ca92

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              fdf1df56dc0257e0af7a37231ca23fe65bb9f05eb99aca2f122a5c25aa0b4235

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              de0d8551b058559fd0db17ba794d212d4336193035c8466740280a0bbaf6f192ae22f7b5404fe3a8c1ac3169d65c55d1f6f29167e374a4a09158eeaa5f526ac5

                                                                                                                                                                                                                                                                                            • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              c2311b035531a4a7e536e91065a2eadd

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              a4bd875b22dc76ce59bfb34a410b774abe97ca92

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              fdf1df56dc0257e0af7a37231ca23fe65bb9f05eb99aca2f122a5c25aa0b4235

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              de0d8551b058559fd0db17ba794d212d4336193035c8466740280a0bbaf6f192ae22f7b5404fe3a8c1ac3169d65c55d1f6f29167e374a4a09158eeaa5f526ac5

                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              212bce6c4fb1614fd4a6660f3f7f95c4

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              c4bed0e6197c048e2de0c97003757ccd2d0b1fd6

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              ba1f6e9b45e76507f69f0274472d664ed492da68a1dfb1266e5837c9fda44de2

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              61e711d57c232bd6e979f8f86936d0a976d3754a428002609f42210122948285e0492a906bda16cbee749edfea5160ef4a51e7dc582051bc48d850804e5a984f

                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              212bce6c4fb1614fd4a6660f3f7f95c4

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              c4bed0e6197c048e2de0c97003757ccd2d0b1fd6

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              ba1f6e9b45e76507f69f0274472d664ed492da68a1dfb1266e5837c9fda44de2

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              61e711d57c232bd6e979f8f86936d0a976d3754a428002609f42210122948285e0492a906bda16cbee749edfea5160ef4a51e7dc582051bc48d850804e5a984f

                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\update.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              42a1e3b52207de4054ed3ef2ec0aa581

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              cb3c09ff013e6b966588245b96b3c4b1e6aea295

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              f748c8b42e42904fddef041c8675ceee6896aacbcafec48857fb6f80d5139539

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4612365b7073f771c4bf634016f38bee06216241f8edf0cf8c7fdc3b39ca135c2f9c433f9366f5efce8bc4f368d5600e1fafaeebbc340e79708fa9d9ec767333

                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\update.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              42a1e3b52207de4054ed3ef2ec0aa581

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              cb3c09ff013e6b966588245b96b3c4b1e6aea295

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              f748c8b42e42904fddef041c8675ceee6896aacbcafec48857fb6f80d5139539

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4612365b7073f771c4bf634016f38bee06216241f8edf0cf8c7fdc3b39ca135c2f9c433f9366f5efce8bc4f368d5600e1fafaeebbc340e79708fa9d9ec767333

                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              877ec1b974206ce2eaebc94d886f5b16

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              6100ce6211e955804024ed8d44ca8a5fa85a8a17

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              b9bbddd54d955141d4f714154d0b437c15dca04f40dc3fefb64851d610e7188f

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              35d075ead154939737dc741abe66f92ea60cb0cf762db9f787ffd3c7eba3777fdbe42db14c8537344726e5c75562938fdbce885b0c69ec9813d1ea7c562399c2

                                                                                                                                                                                                                                                                                            • C:\Program Files\Google\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              877ec1b974206ce2eaebc94d886f5b16

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              6100ce6211e955804024ed8d44ca8a5fa85a8a17

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              b9bbddd54d955141d4f714154d0b437c15dca04f40dc3fefb64851d610e7188f

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              35d075ead154939737dc741abe66f92ea60cb0cf762db9f787ffd3c7eba3777fdbe42db14c8537344726e5c75562938fdbce885b0c69ec9813d1ea7c562399c2

                                                                                                                                                                                                                                                                                            • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              aa8e904056d85defb8592a229c04ed4f

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              2819ab2e9cf526afae649b386ba6b2b32474695c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              577433c3e00f92d5734230663b20a30ff0d19a77efc6cfdb387cf05c46593d64

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              b5bf80a14e354732e524940ae25e9e5e76efa36811593f95f652f95f46e287260b9172bdd8104b7282c81d8160101ab85f69a85f18795c37ded2ec8bc6f903a3

                                                                                                                                                                                                                                                                                            • C:\Program Files\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              aa8e904056d85defb8592a229c04ed4f

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              2819ab2e9cf526afae649b386ba6b2b32474695c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              577433c3e00f92d5734230663b20a30ff0d19a77efc6cfdb387cf05c46593d64

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              b5bf80a14e354732e524940ae25e9e5e76efa36811593f95f652f95f46e287260b9172bdd8104b7282c81d8160101ab85f69a85f18795c37ded2ec8bc6f903a3

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2576044659\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              bf7e1ce8565e103b6042b90d3cfaea97

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              7d610b2d80e6c5bfa1f5c25f0e4e46d76eea6763

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              1cc8a5f711cd817089239a6c5212b50e925343a2a4db3609087e2458e035273d

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4380be6499f67dcb5aabc6816c16afd6057ee22dd4666b7c93cab530c7cc73cc6282a5cb3fd233564af4f63feebc9137b2794036d782e9b0d60d178b1d411dd8

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2576044659\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              bf7e1ce8565e103b6042b90d3cfaea97

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              7d610b2d80e6c5bfa1f5c25f0e4e46d76eea6763

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              1cc8a5f711cd817089239a6c5212b50e925343a2a4db3609087e2458e035273d

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              4380be6499f67dcb5aabc6816c16afd6057ee22dd4666b7c93cab530c7cc73cc6282a5cb3fd233564af4f63feebc9137b2794036d782e9b0d60d178b1d411dd8

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              94bf19d1bc6f18c5e51c780948e6760c

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              97a1bb1ee59622d64bf844cf66f6d248994315ee

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              d91135bbf5b898f6fa05f333ba81e200a7ce57816580db371ddbddb51c6d1814

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              a03596e4ec4e1439c7aa9048fcb76120d465fb99c3db12591edb14ec4e233f97d609d2dc055b71fe2e2be375236d00ab3a4d413c18e0574bcc3bfcfcc19cd5b4

                                                                                                                                                                                                                                                                                            • C:\data.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              1ba82ec7c01fe5acd2f6cb03fcf14042

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              dfc54436361b1757fe954e6e12c4d1d7deb9922e

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              8c4d87cd70d56b20ccfb9e7df629100947409f2071b643d535733c835a4ca606

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              579a987cc38a3f35e0280fcc7db0c4531aa9a4e40967c16acb09cf5b742c27af8aac2d86e86ec44cfa4a9ce4c7661d6462abf30e85fc1055e2a8b33d396d804f

                                                                                                                                                                                                                                                                                            • C:\data.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              1ba82ec7c01fe5acd2f6cb03fcf14042

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              dfc54436361b1757fe954e6e12c4d1d7deb9922e

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              8c4d87cd70d56b20ccfb9e7df629100947409f2071b643d535733c835a4ca606

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              579a987cc38a3f35e0280fcc7db0c4531aa9a4e40967c16acb09cf5b742c27af8aac2d86e86ec44cfa4a9ce4c7661d6462abf30e85fc1055e2a8b33d396d804f

                                                                                                                                                                                                                                                                                            • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              aa8e904056d85defb8592a229c04ed4f

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              2819ab2e9cf526afae649b386ba6b2b32474695c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              577433c3e00f92d5734230663b20a30ff0d19a77efc6cfdb387cf05c46593d64

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              b5bf80a14e354732e524940ae25e9e5e76efa36811593f95f652f95f46e287260b9172bdd8104b7282c81d8160101ab85f69a85f18795c37ded2ec8bc6f903a3

                                                                                                                                                                                                                                                                                            • C:\odt\backup.exe

                                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                                              aa8e904056d85defb8592a229c04ed4f

                                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                                              2819ab2e9cf526afae649b386ba6b2b32474695c

                                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                                              577433c3e00f92d5734230663b20a30ff0d19a77efc6cfdb387cf05c46593d64

                                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                                              b5bf80a14e354732e524940ae25e9e5e76efa36811593f95f652f95f46e287260b9172bdd8104b7282c81d8160101ab85f69a85f18795c37ded2ec8bc6f903a3