Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    207s
  • max time network
    224s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 16:48

General

  • Target

    b7e884402cf92d4ef063c4a05dfa4dd5e969f8fe7b94540fe187335f1ae6d753.exe

  • Size

    72KB

  • MD5

    09a8a2ab21853be9ae1cd074a5134a62

  • SHA1

    b402fe5821c76be606355e70b6fa73b8b1cba3e6

  • SHA256

    b7e884402cf92d4ef063c4a05dfa4dd5e969f8fe7b94540fe187335f1ae6d753

  • SHA512

    bb9820339abb4ec95176515754a40cbf21321e69f44fd85fcac793bcdd4ed713ee732949381bffac92ed760cc7a941ce787d8d94a8c9c85d02069f4e02a3d518

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2n:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPz

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7e884402cf92d4ef063c4a05dfa4dd5e969f8fe7b94540fe187335f1ae6d753.exe
    "C:\Users\Admin\AppData\Local\Temp\b7e884402cf92d4ef063c4a05dfa4dd5e969f8fe7b94540fe187335f1ae6d753.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\2029020910\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2029020910\backup.exe C:\Users\Admin\AppData\Local\Temp\2029020910\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4596
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2780
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4368
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4788
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:904
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:4292
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3084
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:3020
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3464
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:768
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:5032
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3096
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:3916
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4016
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2832
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\update.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4696
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:4432
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2304
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:880
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\update.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\update.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:2420
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:4784
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:4048
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                    PID:936
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                    8⤵
                      PID:384
                    • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                      8⤵
                      • System policy modification
                      PID:2728
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                      8⤵
                      • Drops file in Program Files directory
                      PID:4140
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                        9⤵
                          PID:808
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                          9⤵
                            PID:3640
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                            9⤵
                              PID:4388
                            • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                              9⤵
                                PID:4780
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:680
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4280
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4736
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1992
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1044
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4404
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2180
                          • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                            7⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:3636
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:1652
                          • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                            7⤵
                            • System policy modification
                            PID:3512
                          • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:588
                          • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                            7⤵
                            • System policy modification
                            PID:1580
                          • C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Drops file in Program Files directory
                            PID:4292
                            • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                              8⤵
                                PID:936
                            • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                              7⤵
                                PID:1148
                                • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\update.exe
                                  "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                  8⤵
                                    PID:3332
                                • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                  7⤵
                                    PID:4220
                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                    7⤵
                                    • System policy modification
                                    PID:3728
                                  • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    PID:384
                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                      8⤵
                                        PID:4696
                                  • C:\Program Files\Common Files\Services\backup.exe
                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2592
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1352
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4868
                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4224
                                      • C:\Program Files\Common Files\System\ado\en-US\System Restore.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\System Restore.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4640
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2844
                                      • C:\Program Files\Common Files\System\ado\fr-FR\data.exe
                                        "C:\Program Files\Common Files\System\ado\fr-FR\data.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:4388
                                      • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:5096
                                      • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3384
                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:4532
                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                      7⤵
                                        PID:1176
                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • System policy modification
                                        PID:4340
                                      • C:\Program Files\Common Files\System\fr-FR\update.exe
                                        "C:\Program Files\Common Files\System\fr-FR\update.exe" C:\Program Files\Common Files\System\fr-FR\
                                        7⤵
                                        • System policy modification
                                        PID:4432
                                      • C:\Program Files\Common Files\System\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                        7⤵
                                          PID:1888
                                        • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                          7⤵
                                            PID:4660
                                          • C:\Program Files\Common Files\System\msadc\backup.exe
                                            "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                            7⤵
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:756
                                            • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                              "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:5072
                                            • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                              8⤵
                                                PID:1348
                                              • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                8⤵
                                                  PID:3624
                                          • C:\Program Files\Google\backup.exe
                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                            5⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3664
                                            • C:\Program Files\Google\Chrome\backup.exe
                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4212
                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:4032
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:4756
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:3200
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4172
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\data.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2940
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                    9⤵
                                                      PID:4736
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                      9⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      PID:540
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                      9⤵
                                                      • Disables RegEdit via registry modification
                                                      • System policy modification
                                                      PID:3804
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                      9⤵
                                                        PID:1392
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                        9⤵
                                                          PID:588
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                            10⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Drops file in Program Files directory
                                                            PID:1580
                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                              11⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:4772
                                                      • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                        8⤵
                                                          PID:3768
                                                  • C:\Program Files\Internet Explorer\backup.exe
                                                    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:4284
                                                    • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                      "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                      6⤵
                                                        PID:4024
                                                      • C:\Program Files\Internet Explorer\en-US\System Restore.exe
                                                        "C:\Program Files\Internet Explorer\en-US\System Restore.exe" C:\Program Files\Internet Explorer\en-US\
                                                        6⤵
                                                        • System policy modification
                                                        PID:2812
                                                      • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                        "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                        6⤵
                                                        • Disables RegEdit via registry modification
                                                        PID:2688
                                                      • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                        "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                        6⤵
                                                          PID:1916
                                                        • C:\Program Files\Internet Explorer\images\backup.exe
                                                          "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                          6⤵
                                                            PID:4400
                                                          • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                            "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                            6⤵
                                                              PID:3860
                                                            • C:\Program Files\Internet Explorer\ja-JP\data.exe
                                                              "C:\Program Files\Internet Explorer\ja-JP\data.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                              6⤵
                                                              • System policy modification
                                                              PID:4748
                                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              PID:1728
                                                          • C:\Program Files\Java\backup.exe
                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                            5⤵
                                                              PID:1060
                                                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                                6⤵
                                                                  PID:4304
                                                                  • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                                    7⤵
                                                                    • System policy modification
                                                                    PID:2476
                                                                  • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                                                    "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                                    7⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • Drops file in Program Files directory
                                                                    • System policy modification
                                                                    PID:5096
                                                                    • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                                      8⤵
                                                                      • System policy modification
                                                                      PID:1816
                                                                    • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                                      8⤵
                                                                        PID:4136
                                                                    • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                                      "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                                      7⤵
                                                                        PID:208
                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                    5⤵
                                                                    • Drops file in Program Files directory
                                                                    • System policy modification
                                                                    PID:4884
                                                                    • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                                      "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                                      6⤵
                                                                        PID:1816
                                                                      • C:\Program Files\Microsoft Office\PackageManifests\System Restore.exe
                                                                        "C:\Program Files\Microsoft Office\PackageManifests\System Restore.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                                        6⤵
                                                                        • Disables RegEdit via registry modification
                                                                        PID:3924
                                                                      • C:\Program Files\Microsoft Office\root\backup.exe
                                                                        "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                                        6⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • Drops file in Program Files directory
                                                                        PID:3648
                                                                        • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                          "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:1144
                                                                        • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                          "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System policy modification
                                                                          PID:4220
                                                                          • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                            "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                            8⤵
                                                                              PID:4720
                                                                      • C:\Program Files\Microsoft Office 15\update.exe
                                                                        "C:\Program Files\Microsoft Office 15\update.exe" C:\Program Files\Microsoft Office 15\
                                                                        5⤵
                                                                          PID:4268
                                                                      • C:\Program Files (x86)\backup.exe
                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                        4⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3340
                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                          5⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1616
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                            6⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:5012
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                              7⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4364
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                              7⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:4184
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4816
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\System Restore.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:384
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1208
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\update.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                  9⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:768
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:4592
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                8⤵
                                                                                  PID:2728
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                  8⤵
                                                                                  • System policy modification
                                                                                  PID:4620
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\update.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • System policy modification
                                                                                    PID:4480
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                  8⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Program Files directory
                                                                                  PID:2348
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                    9⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:372
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                  8⤵
                                                                                    PID:884
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\update.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                    8⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:4136
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                      9⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:1620
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\System Restore.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                    8⤵
                                                                                    • Drops file in Program Files directory
                                                                                    PID:3512
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                                      9⤵
                                                                                        PID:4456
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                                      8⤵
                                                                                        PID:2688
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                                          9⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          PID:4660
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                      7⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Executes dropped EXE
                                                                                      • Drops file in Program Files directory
                                                                                      PID:4976
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                        8⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • System policy modification
                                                                                        PID:4524
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                          9⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • System policy modification
                                                                                          PID:1284
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                        8⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        PID:1180
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                        8⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Drops file in Program Files directory
                                                                                        PID:3500
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                          9⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:4496
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                            10⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:552
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                                            10⤵
                                                                                              PID:3036
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                                11⤵
                                                                                                  PID:3784
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\
                                                                                                  11⤵
                                                                                                    PID:2256
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                            7⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:4204
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                              8⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:2096
                                                                                      • C:\Program Files (x86)\Common Files\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                        5⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1092
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                          6⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Drops file in Program Files directory
                                                                                          PID:2108
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                            7⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Drops file in Program Files directory
                                                                                            PID:2260
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                            7⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            • System policy modification
                                                                                            PID:4368
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                              8⤵
                                                                                                PID:1356
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                              7⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              • System policy modification
                                                                                              PID:4724
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:4540
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\data.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\data.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                              7⤵
                                                                                              • Drops file in Program Files directory
                                                                                              • System policy modification
                                                                                              PID:2812
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                8⤵
                                                                                                • System policy modification
                                                                                                PID:816
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\
                                                                                                  9⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:3452
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\
                                                                                                    10⤵
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    PID:4956
                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\
                                                                                                    10⤵
                                                                                                      PID:4844
                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Adobe\
                                                                                                        11⤵
                                                                                                          PID:2188
                                                                                              • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                                6⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                PID:680
                                                                                                • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                  7⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • System policy modification
                                                                                                  PID:5092
                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                6⤵
                                                                                                  PID:4364
                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                    7⤵
                                                                                                      PID:1932
                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                      7⤵
                                                                                                      • System policy modification
                                                                                                      PID:2840
                                                                                                    • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                      7⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:884
                                                                                                      • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\
                                                                                                        8⤵
                                                                                                          PID:4352
                                                                                                    • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                      6⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      PID:936
                                                                                                  • C:\Program Files (x86)\Google\backup.exe
                                                                                                    "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                    5⤵
                                                                                                    • Drops file in Program Files directory
                                                                                                    PID:2160
                                                                                                    • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                      "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                      6⤵
                                                                                                        PID:5040
                                                                                                      • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                        "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                        6⤵
                                                                                                          PID:4688
                                                                                                        • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                          "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • System policy modification
                                                                                                          PID:2704
                                                                                                        • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                          "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                          6⤵
                                                                                                            PID:3552
                                                                                                            • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                              "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                              7⤵
                                                                                                                PID:4224
                                                                                                          • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                            "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                            5⤵
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:2492
                                                                                                            • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                              "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                              6⤵
                                                                                                              • System policy modification
                                                                                                              PID:2192
                                                                                                            • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                              "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                              6⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:4300
                                                                                                            • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                              "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                              6⤵
                                                                                                              • System policy modification
                                                                                                              PID:3804
                                                                                                            • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                              "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                              6⤵
                                                                                                                PID:2292
                                                                                                              • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                6⤵
                                                                                                                  PID:1632
                                                                                                              • C:\Program Files (x86)\Microsoft\backup.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\backup.exe" C:\Program Files (x86)\Microsoft\
                                                                                                                5⤵
                                                                                                                  PID:5020
                                                                                                              • C:\Users\backup.exe
                                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                                4⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                PID:4644
                                                                                                                • C:\Users\Admin\backup.exe
                                                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                  5⤵
                                                                                                                    PID:1132
                                                                                                                    • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                      "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      PID:2860
                                                                                                                    • C:\Users\Admin\Contacts\backup.exe
                                                                                                                      C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      PID:2744
                                                                                                                    • C:\Users\Admin\Desktop\backup.exe
                                                                                                                      C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • System policy modification
                                                                                                                      PID:5096
                                                                                                                    • C:\Users\Admin\Documents\update.exe
                                                                                                                      C:\Users\Admin\Documents\update.exe C:\Users\Admin\Documents\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • System policy modification
                                                                                                                      PID:2704
                                                                                                                    • C:\Users\Admin\Downloads\backup.exe
                                                                                                                      C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                      6⤵
                                                                                                                        PID:1632
                                                                                                                      • C:\Users\Admin\Favorites\backup.exe
                                                                                                                        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                        6⤵
                                                                                                                          PID:1888
                                                                                                                        • C:\Users\Admin\Links\backup.exe
                                                                                                                          C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                          6⤵
                                                                                                                            PID:4736
                                                                                                                          • C:\Users\Admin\Music\backup.exe
                                                                                                                            C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                            6⤵
                                                                                                                              PID:1712
                                                                                                                          • C:\Users\Public\backup.exe
                                                                                                                            C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                            5⤵
                                                                                                                              PID:3020
                                                                                                                              • C:\Users\Public\Documents\backup.exe
                                                                                                                                C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                6⤵
                                                                                                                                  PID:2620
                                                                                                                                • C:\Users\Public\Downloads\backup.exe
                                                                                                                                  C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                  6⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  • System policy modification
                                                                                                                                  PID:2344
                                                                                                                                • C:\Users\Public\Music\update.exe
                                                                                                                                  C:\Users\Public\Music\update.exe C:\Users\Public\Music\
                                                                                                                                  6⤵
                                                                                                                                    PID:3112
                                                                                                                                  • C:\Users\Public\Pictures\backup.exe
                                                                                                                                    C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                    6⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    PID:3116
                                                                                                                                  • C:\Users\Public\Videos\backup.exe
                                                                                                                                    C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                    6⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    PID:944
                                                                                                                              • C:\Windows\backup.exe
                                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                                4⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3644
                                                                                                                                • C:\Windows\addins\update.exe
                                                                                                                                  C:\Windows\addins\update.exe C:\Windows\addins\
                                                                                                                                  5⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:3012
                                                                                                                                • C:\Windows\appcompat\backup.exe
                                                                                                                                  C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                  5⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:448
                                                                                                                                  • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                    C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                    6⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Drops file in Windows directory
                                                                                                                                    • System policy modification
                                                                                                                                    PID:4212
                                                                                                                                    • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                      C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                      7⤵
                                                                                                                                        PID:1752
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:5116
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4420
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:1092
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                              2⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:4552
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                              2⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              PID:448
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                              2⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                              • System policy modification
                                                                                                                              PID:3948

                                                                                                                          Network

                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                          Replay Monitor

                                                                                                                          Loading Replay Monitor...

                                                                                                                          Downloads

                                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            91353ad97e28b582002dd409c933b858

                                                                                                                            SHA1

                                                                                                                            eb6da072d62cee3ef4a5c7d6bbb7decb7b1506f0

                                                                                                                            SHA256

                                                                                                                            429c1746c4663524eec243658642611e6f47d55fe4c307b07deeb0ddbb01fecd

                                                                                                                            SHA512

                                                                                                                            9bb93a012bf13b793e58fea8cf00bad8b843efeb2427458b21d9737e4e1d7116fa46a2669e2325320642b611eed1511cf59d32fbd29b36587fa0ac3099ed4fc3

                                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            91353ad97e28b582002dd409c933b858

                                                                                                                            SHA1

                                                                                                                            eb6da072d62cee3ef4a5c7d6bbb7decb7b1506f0

                                                                                                                            SHA256

                                                                                                                            429c1746c4663524eec243658642611e6f47d55fe4c307b07deeb0ddbb01fecd

                                                                                                                            SHA512

                                                                                                                            9bb93a012bf13b793e58fea8cf00bad8b843efeb2427458b21d9737e4e1d7116fa46a2669e2325320642b611eed1511cf59d32fbd29b36587fa0ac3099ed4fc3

                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            c0657810c5bc4adf017301aead8bd35a

                                                                                                                            SHA1

                                                                                                                            e2b6e61e1c5a67d48e2c75f45dfb10b73292153e

                                                                                                                            SHA256

                                                                                                                            1d209c54725bef06966bf8d64c0d6afd82a4056e60a5bcea7aa5555b0ee0ab1b

                                                                                                                            SHA512

                                                                                                                            2144504b49d8d7a643b69bf3737f3623eb22ddb90d326b0159a918483eb57793225dcb50bcb44def0ba4847966f2b3b379bb9ce1a88afa8575f0fcc6c6ae0aa5

                                                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            c0657810c5bc4adf017301aead8bd35a

                                                                                                                            SHA1

                                                                                                                            e2b6e61e1c5a67d48e2c75f45dfb10b73292153e

                                                                                                                            SHA256

                                                                                                                            1d209c54725bef06966bf8d64c0d6afd82a4056e60a5bcea7aa5555b0ee0ab1b

                                                                                                                            SHA512

                                                                                                                            2144504b49d8d7a643b69bf3737f3623eb22ddb90d326b0159a918483eb57793225dcb50bcb44def0ba4847966f2b3b379bb9ce1a88afa8575f0fcc6c6ae0aa5

                                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            a55f6b6c836b0467af526158eb146070

                                                                                                                            SHA1

                                                                                                                            505762921fbb44b7da939003098d941b8e976b0f

                                                                                                                            SHA256

                                                                                                                            181ad2bd43f639cf7e7df96fc33d419afacb2dca73f405a1593ff4bfa367af69

                                                                                                                            SHA512

                                                                                                                            ec277d5f96f75ad453015fad7664143202784c48d6d59cd1fed4e805df1f084c8e4cf5786b1d77914b00a1616be35fe8a198f208a3092643e3e38c48c5834131

                                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            a55f6b6c836b0467af526158eb146070

                                                                                                                            SHA1

                                                                                                                            505762921fbb44b7da939003098d941b8e976b0f

                                                                                                                            SHA256

                                                                                                                            181ad2bd43f639cf7e7df96fc33d419afacb2dca73f405a1593ff4bfa367af69

                                                                                                                            SHA512

                                                                                                                            ec277d5f96f75ad453015fad7664143202784c48d6d59cd1fed4e805df1f084c8e4cf5786b1d77914b00a1616be35fe8a198f208a3092643e3e38c48c5834131

                                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            8d8a7d743c691e571905abc5800f97de

                                                                                                                            SHA1

                                                                                                                            c6f2cb571bdf42c1d03417e88100e5bed967d8e3

                                                                                                                            SHA256

                                                                                                                            380bfe8eebb4de4440f6dd9d3fffb3b1ea048cb1a40237d96c58f41766292f16

                                                                                                                            SHA512

                                                                                                                            604294fcc96fddee8c9f3fef23036dcc2fcc2be26c4c7bad5c8ee0a4a5bbd3d772965658e3669b5e859cd176b30f7dc649379d3b0a996f79987e952e6a821460

                                                                                                                          • C:\Program Files (x86)\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            8d8a7d743c691e571905abc5800f97de

                                                                                                                            SHA1

                                                                                                                            c6f2cb571bdf42c1d03417e88100e5bed967d8e3

                                                                                                                            SHA256

                                                                                                                            380bfe8eebb4de4440f6dd9d3fffb3b1ea048cb1a40237d96c58f41766292f16

                                                                                                                            SHA512

                                                                                                                            604294fcc96fddee8c9f3fef23036dcc2fcc2be26c4c7bad5c8ee0a4a5bbd3d772965658e3669b5e859cd176b30f7dc649379d3b0a996f79987e952e6a821460

                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f88a4ad9ee86b313c991276b5dfa800f

                                                                                                                            SHA1

                                                                                                                            f6fabae7416177f7e1904a81cf7cbc092a478be2

                                                                                                                            SHA256

                                                                                                                            b14c3ba69b083963a12a8030179ac1d15d91882071a8947e66119a56ed481da1

                                                                                                                            SHA512

                                                                                                                            8c25acc53fb4eeafb0e65f327650ffb8da0535ce2da38a658c42288f143e3c52ca2aedc5f4db197175e0ebed773ea309245cb58d79f6fb91a9aa775474913063

                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f88a4ad9ee86b313c991276b5dfa800f

                                                                                                                            SHA1

                                                                                                                            f6fabae7416177f7e1904a81cf7cbc092a478be2

                                                                                                                            SHA256

                                                                                                                            b14c3ba69b083963a12a8030179ac1d15d91882071a8947e66119a56ed481da1

                                                                                                                            SHA512

                                                                                                                            8c25acc53fb4eeafb0e65f327650ffb8da0535ce2da38a658c42288f143e3c52ca2aedc5f4db197175e0ebed773ea309245cb58d79f6fb91a9aa775474913063

                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f198e047835ae210ffcbec6c78783ce8

                                                                                                                            SHA1

                                                                                                                            1369efab5277eea00e842e2e30e225fcc87be0b9

                                                                                                                            SHA256

                                                                                                                            2633b7c8351a8f66afb289a9b37ca47305882e7feab96a424e4a957eb743ea42

                                                                                                                            SHA512

                                                                                                                            c249578134ba2e05e003e0609e2ca35dd69a3720b7f027feed31e0e4227cd8193c14e096618694451bcc6780c6137c822a72c7c81e7f978e9b11051d82102ced

                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f198e047835ae210ffcbec6c78783ce8

                                                                                                                            SHA1

                                                                                                                            1369efab5277eea00e842e2e30e225fcc87be0b9

                                                                                                                            SHA256

                                                                                                                            2633b7c8351a8f66afb289a9b37ca47305882e7feab96a424e4a957eb743ea42

                                                                                                                            SHA512

                                                                                                                            c249578134ba2e05e003e0609e2ca35dd69a3720b7f027feed31e0e4227cd8193c14e096618694451bcc6780c6137c822a72c7c81e7f978e9b11051d82102ced

                                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9ab465f85cff1604473692ce4bd76a37

                                                                                                                            SHA1

                                                                                                                            a903582fdd724eee24d409b0a211942518b97f76

                                                                                                                            SHA256

                                                                                                                            14673ca43556bba6c7a770f415d0446f5b20d1d115f5d049b236130136661af7

                                                                                                                            SHA512

                                                                                                                            65cd4d59d79f8257e3c571691bf64d2ab815b385cfd3403f30b3a9cb623bd51198ea213072db7af81e7b788defd70af5125b4d17f1b6362ce19f6c0896e28ee1

                                                                                                                          • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9ab465f85cff1604473692ce4bd76a37

                                                                                                                            SHA1

                                                                                                                            a903582fdd724eee24d409b0a211942518b97f76

                                                                                                                            SHA256

                                                                                                                            14673ca43556bba6c7a770f415d0446f5b20d1d115f5d049b236130136661af7

                                                                                                                            SHA512

                                                                                                                            65cd4d59d79f8257e3c571691bf64d2ab815b385cfd3403f30b3a9cb623bd51198ea213072db7af81e7b788defd70af5125b4d17f1b6362ce19f6c0896e28ee1

                                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            0790303271c064e4d2a3ff492d3c872f

                                                                                                                            SHA1

                                                                                                                            5e3df8ea07f700119874a449e20fd2e49d637088

                                                                                                                            SHA256

                                                                                                                            3439cd3a2ed3bc8055fa18a65535c22dfb4a682ea0c255ea69e99ee9705f0366

                                                                                                                            SHA512

                                                                                                                            990d8898b0e01071bd594043ffb807e83ce96bafddea7a5f1c59e48eb8d1787d9c8a162396a8971857bee1392839fb571f9e273df16781e84f1f36b2e99fbb95

                                                                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            0790303271c064e4d2a3ff492d3c872f

                                                                                                                            SHA1

                                                                                                                            5e3df8ea07f700119874a449e20fd2e49d637088

                                                                                                                            SHA256

                                                                                                                            3439cd3a2ed3bc8055fa18a65535c22dfb4a682ea0c255ea69e99ee9705f0366

                                                                                                                            SHA512

                                                                                                                            990d8898b0e01071bd594043ffb807e83ce96bafddea7a5f1c59e48eb8d1787d9c8a162396a8971857bee1392839fb571f9e273df16781e84f1f36b2e99fbb95

                                                                                                                          • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            6485cf4ed4fe4369f79b37bfe139fc8b

                                                                                                                            SHA1

                                                                                                                            5647f98e16afae3286af35fe5f7b42e0ee3bb28d

                                                                                                                            SHA256

                                                                                                                            23a9c9ec49922de17964a3984cd96c7b3465d42b4c858bf5571eaa9451830f5a

                                                                                                                            SHA512

                                                                                                                            ba67851efc327ac93de0214a7a05900383b8c7f3d9511aedee399fcbed411aa6bb05c90819985ff01be40c3797fb21e17d87c3acda6b50c4aac82357f3bf8546

                                                                                                                          • C:\Program Files\Common Files\System\ado\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            6485cf4ed4fe4369f79b37bfe139fc8b

                                                                                                                            SHA1

                                                                                                                            5647f98e16afae3286af35fe5f7b42e0ee3bb28d

                                                                                                                            SHA256

                                                                                                                            23a9c9ec49922de17964a3984cd96c7b3465d42b4c858bf5571eaa9451830f5a

                                                                                                                            SHA512

                                                                                                                            ba67851efc327ac93de0214a7a05900383b8c7f3d9511aedee399fcbed411aa6bb05c90819985ff01be40c3797fb21e17d87c3acda6b50c4aac82357f3bf8546

                                                                                                                          • C:\Program Files\Common Files\System\ado\de-DE\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            8a20c488a31740feb368f1c724924bd5

                                                                                                                            SHA1

                                                                                                                            6d3697be97604e7e3ab77c779ac444bde232c387

                                                                                                                            SHA256

                                                                                                                            7c3406906b68f3ebeb46bda9cc55b678976a72e878344d267f6b7b739c9f3790

                                                                                                                            SHA512

                                                                                                                            74f618bf102456a400b4ee4eb07465e3fde1abfbf6207e36cc40f1506e3851d28f814e746332fd55c1d05ace23328a681d726d15b36fe68c452528b16af6854a

                                                                                                                          • C:\Program Files\Common Files\System\ado\de-DE\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            8a20c488a31740feb368f1c724924bd5

                                                                                                                            SHA1

                                                                                                                            6d3697be97604e7e3ab77c779ac444bde232c387

                                                                                                                            SHA256

                                                                                                                            7c3406906b68f3ebeb46bda9cc55b678976a72e878344d267f6b7b739c9f3790

                                                                                                                            SHA512

                                                                                                                            74f618bf102456a400b4ee4eb07465e3fde1abfbf6207e36cc40f1506e3851d28f814e746332fd55c1d05ace23328a681d726d15b36fe68c452528b16af6854a

                                                                                                                          • C:\Program Files\Common Files\System\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            619a5cbd1f19059801edb359144aa144

                                                                                                                            SHA1

                                                                                                                            7b9660551ae362474dc4ace0b24dcd4e11ede8b6

                                                                                                                            SHA256

                                                                                                                            01f666bfae0cdca0130889bb8d9a13c9a230cd770ee6722539103de2722ba706

                                                                                                                            SHA512

                                                                                                                            48d0def5d45048ddcb93dedc2d8d28308b7e94178101921ee191546cd6b1e9fafa5bbb6c7572388a646678f1feac8428f218a4d4795f6324a6941d9ca71c66d8

                                                                                                                          • C:\Program Files\Common Files\System\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            619a5cbd1f19059801edb359144aa144

                                                                                                                            SHA1

                                                                                                                            7b9660551ae362474dc4ace0b24dcd4e11ede8b6

                                                                                                                            SHA256

                                                                                                                            01f666bfae0cdca0130889bb8d9a13c9a230cd770ee6722539103de2722ba706

                                                                                                                            SHA512

                                                                                                                            48d0def5d45048ddcb93dedc2d8d28308b7e94178101921ee191546cd6b1e9fafa5bbb6c7572388a646678f1feac8428f218a4d4795f6324a6941d9ca71c66d8

                                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            e5e391eb4404c0f4f05476320772a322

                                                                                                                            SHA1

                                                                                                                            89ef9fc658356195ceb3d78a8377c40ce78317c2

                                                                                                                            SHA256

                                                                                                                            ecb5bbf73979762a1b98e626cf8067d1423019afa0d08a51d068299483d04bce

                                                                                                                            SHA512

                                                                                                                            332e9d0ed4f1d478d4de471aa15169f704228c4194ffadc08f30d1527b3f670416eefbadfef56213e3cbda75020aec8de4d708c4396c62e207ef89ae304feed5

                                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            e5e391eb4404c0f4f05476320772a322

                                                                                                                            SHA1

                                                                                                                            89ef9fc658356195ceb3d78a8377c40ce78317c2

                                                                                                                            SHA256

                                                                                                                            ecb5bbf73979762a1b98e626cf8067d1423019afa0d08a51d068299483d04bce

                                                                                                                            SHA512

                                                                                                                            332e9d0ed4f1d478d4de471aa15169f704228c4194ffadc08f30d1527b3f670416eefbadfef56213e3cbda75020aec8de4d708c4396c62e207ef89ae304feed5

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            dc2569a21bbd4504d233fdfb3e449dc2

                                                                                                                            SHA1

                                                                                                                            051fb48d168a6876da974bbb7e5917920438925e

                                                                                                                            SHA256

                                                                                                                            d2177d0c2f0adeee71046c4e7a8c53f6266d1651ff9724e1f0323e790297047e

                                                                                                                            SHA512

                                                                                                                            3faba9f194a16534d3f3b056d273feaf19f228730747bb2726889922a1eb8f6e72f3135b4217588000fe59b3c2980c25758d0870f364b4b15a98962e2a86142c

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            dc2569a21bbd4504d233fdfb3e449dc2

                                                                                                                            SHA1

                                                                                                                            051fb48d168a6876da974bbb7e5917920438925e

                                                                                                                            SHA256

                                                                                                                            d2177d0c2f0adeee71046c4e7a8c53f6266d1651ff9724e1f0323e790297047e

                                                                                                                            SHA512

                                                                                                                            3faba9f194a16534d3f3b056d273feaf19f228730747bb2726889922a1eb8f6e72f3135b4217588000fe59b3c2980c25758d0870f364b4b15a98962e2a86142c

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            8b27c0e573c374135968695d797b29ad

                                                                                                                            SHA1

                                                                                                                            222297d61cc536a91838953b8c19ccce39677cb2

                                                                                                                            SHA256

                                                                                                                            c24eb82bf6a31f8788503e278e3b628ca5f88b75ef180878510aa67767b7f090

                                                                                                                            SHA512

                                                                                                                            b26adc87c284dd6e5647b22c5d63e1faa50a4a41f7528d5104a68598fe8ba8035f194cf0851ddce86c2d576391be94e0c36736c1789b4676152b74b4050ea709

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            8b27c0e573c374135968695d797b29ad

                                                                                                                            SHA1

                                                                                                                            222297d61cc536a91838953b8c19ccce39677cb2

                                                                                                                            SHA256

                                                                                                                            c24eb82bf6a31f8788503e278e3b628ca5f88b75ef180878510aa67767b7f090

                                                                                                                            SHA512

                                                                                                                            b26adc87c284dd6e5647b22c5d63e1faa50a4a41f7528d5104a68598fe8ba8035f194cf0851ddce86c2d576391be94e0c36736c1789b4676152b74b4050ea709

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            3e3d142aa34f8d05dd589ea762bba3d8

                                                                                                                            SHA1

                                                                                                                            d6a3476c2f3a1e007ce79b3c6c8ad7c9b8343b5a

                                                                                                                            SHA256

                                                                                                                            4d0f0c37d29b88734f4870071923eca1daa79b5d92dfd642cb9a002f9aa610c3

                                                                                                                            SHA512

                                                                                                                            265d645db835c566287288cb723d560cd6906c1ae0ab4a20495cdd598f9c6b869cbf1e3590b8181c09bf52ad9329a622f0e61436d1851daaead4a1892fa6304b

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\System Restore.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            3e3d142aa34f8d05dd589ea762bba3d8

                                                                                                                            SHA1

                                                                                                                            d6a3476c2f3a1e007ce79b3c6c8ad7c9b8343b5a

                                                                                                                            SHA256

                                                                                                                            4d0f0c37d29b88734f4870071923eca1daa79b5d92dfd642cb9a002f9aa610c3

                                                                                                                            SHA512

                                                                                                                            265d645db835c566287288cb723d560cd6906c1ae0ab4a20495cdd598f9c6b869cbf1e3590b8181c09bf52ad9329a622f0e61436d1851daaead4a1892fa6304b

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f35dc2a1620d31df408a53984fa69754

                                                                                                                            SHA1

                                                                                                                            f380c23c069b59d0f2dc2e4f30b7c5c5a38cb2f6

                                                                                                                            SHA256

                                                                                                                            cccb0e65259cbc054d0e5f145d262ec99943441e5010476470fea9d69bc2aff4

                                                                                                                            SHA512

                                                                                                                            3f31d9b80108ac599e3ac9e230ddfae5436f9ab5f9536a3cc9243cc61ae02e7f89c1d0e9a6c74a7b17a2a20a275cf19e04fbf68cce8936b4ba1b5615c3f2ecc9

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f35dc2a1620d31df408a53984fa69754

                                                                                                                            SHA1

                                                                                                                            f380c23c069b59d0f2dc2e4f30b7c5c5a38cb2f6

                                                                                                                            SHA256

                                                                                                                            cccb0e65259cbc054d0e5f145d262ec99943441e5010476470fea9d69bc2aff4

                                                                                                                            SHA512

                                                                                                                            3f31d9b80108ac599e3ac9e230ddfae5436f9ab5f9536a3cc9243cc61ae02e7f89c1d0e9a6c74a7b17a2a20a275cf19e04fbf68cce8936b4ba1b5615c3f2ecc9

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9ab465f85cff1604473692ce4bd76a37

                                                                                                                            SHA1

                                                                                                                            a903582fdd724eee24d409b0a211942518b97f76

                                                                                                                            SHA256

                                                                                                                            14673ca43556bba6c7a770f415d0446f5b20d1d115f5d049b236130136661af7

                                                                                                                            SHA512

                                                                                                                            65cd4d59d79f8257e3c571691bf64d2ab815b385cfd3403f30b3a9cb623bd51198ea213072db7af81e7b788defd70af5125b4d17f1b6362ce19f6c0896e28ee1

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9ab465f85cff1604473692ce4bd76a37

                                                                                                                            SHA1

                                                                                                                            a903582fdd724eee24d409b0a211942518b97f76

                                                                                                                            SHA256

                                                                                                                            14673ca43556bba6c7a770f415d0446f5b20d1d115f5d049b236130136661af7

                                                                                                                            SHA512

                                                                                                                            65cd4d59d79f8257e3c571691bf64d2ab815b385cfd3403f30b3a9cb623bd51198ea213072db7af81e7b788defd70af5125b4d17f1b6362ce19f6c0896e28ee1

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            564c6bb35f5edd3979861a2334e90766

                                                                                                                            SHA1

                                                                                                                            dd1ed62139aa0bffbaae2daacf193b1ff986129a

                                                                                                                            SHA256

                                                                                                                            fe0aca819912ef76be9eb7025dd1069b577ee7a8955f5e9b7319050132db734b

                                                                                                                            SHA512

                                                                                                                            9ae0e57170a91fb21fbfcef4ad835bcf32ba3d04d805f19653f53478a66dd04c4e502dfd304b56fcf606776bcc1b138f6f59486d240bf547c1426e21f7772512

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            564c6bb35f5edd3979861a2334e90766

                                                                                                                            SHA1

                                                                                                                            dd1ed62139aa0bffbaae2daacf193b1ff986129a

                                                                                                                            SHA256

                                                                                                                            fe0aca819912ef76be9eb7025dd1069b577ee7a8955f5e9b7319050132db734b

                                                                                                                            SHA512

                                                                                                                            9ae0e57170a91fb21fbfcef4ad835bcf32ba3d04d805f19653f53478a66dd04c4e502dfd304b56fcf606776bcc1b138f6f59486d240bf547c1426e21f7772512

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            dc2569a21bbd4504d233fdfb3e449dc2

                                                                                                                            SHA1

                                                                                                                            051fb48d168a6876da974bbb7e5917920438925e

                                                                                                                            SHA256

                                                                                                                            d2177d0c2f0adeee71046c4e7a8c53f6266d1651ff9724e1f0323e790297047e

                                                                                                                            SHA512

                                                                                                                            3faba9f194a16534d3f3b056d273feaf19f228730747bb2726889922a1eb8f6e72f3135b4217588000fe59b3c2980c25758d0870f364b4b15a98962e2a86142c

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            dc2569a21bbd4504d233fdfb3e449dc2

                                                                                                                            SHA1

                                                                                                                            051fb48d168a6876da974bbb7e5917920438925e

                                                                                                                            SHA256

                                                                                                                            d2177d0c2f0adeee71046c4e7a8c53f6266d1651ff9724e1f0323e790297047e

                                                                                                                            SHA512

                                                                                                                            3faba9f194a16534d3f3b056d273feaf19f228730747bb2726889922a1eb8f6e72f3135b4217588000fe59b3c2980c25758d0870f364b4b15a98962e2a86142c

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            fff5b63e60822830a53803e76155a3ba

                                                                                                                            SHA1

                                                                                                                            6e0f688ce56cbf44868ab4f4a95bdb7c6e6d5231

                                                                                                                            SHA256

                                                                                                                            3e8c9713b75cc44bbbecf47f826686bd805d291996b126b889a0b517ef917693

                                                                                                                            SHA512

                                                                                                                            3d13e437c8b01aaeb194adbaff339b4fa49f4eceeb2cd41ab7c460c3e6864e058693a465097e70b3e0f289f2ea6c9a40b9d72d96b63f3599eff3d1e41a7138c3

                                                                                                                          • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            fff5b63e60822830a53803e76155a3ba

                                                                                                                            SHA1

                                                                                                                            6e0f688ce56cbf44868ab4f4a95bdb7c6e6d5231

                                                                                                                            SHA256

                                                                                                                            3e8c9713b75cc44bbbecf47f826686bd805d291996b126b889a0b517ef917693

                                                                                                                            SHA512

                                                                                                                            3d13e437c8b01aaeb194adbaff339b4fa49f4eceeb2cd41ab7c460c3e6864e058693a465097e70b3e0f289f2ea6c9a40b9d72d96b63f3599eff3d1e41a7138c3

                                                                                                                          • C:\Program Files\Google\Chrome\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f8d7562f18783231a51bea2f5fe71f05

                                                                                                                            SHA1

                                                                                                                            b0f10a65d4596ad47bbe051c9b335715f66ed9fd

                                                                                                                            SHA256

                                                                                                                            b577b6c3102dbf5f29e7058ad90457d90db13285f96e21779755cdfb9b512a3e

                                                                                                                            SHA512

                                                                                                                            6dd232e06e74a52f17ecb1998c6cb16c8a1c16043b3c742a20e9716e2cab920faa6b145ba2538e80d1965d1425d1949766d707666cd0ffef04515c544c67e6f0

                                                                                                                          • C:\Program Files\Google\Chrome\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f8d7562f18783231a51bea2f5fe71f05

                                                                                                                            SHA1

                                                                                                                            b0f10a65d4596ad47bbe051c9b335715f66ed9fd

                                                                                                                            SHA256

                                                                                                                            b577b6c3102dbf5f29e7058ad90457d90db13285f96e21779755cdfb9b512a3e

                                                                                                                            SHA512

                                                                                                                            6dd232e06e74a52f17ecb1998c6cb16c8a1c16043b3c742a20e9716e2cab920faa6b145ba2538e80d1965d1425d1949766d707666cd0ffef04515c544c67e6f0

                                                                                                                          • C:\Program Files\Google\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            aaca0518ff60165fe38e87358e52b7eb

                                                                                                                            SHA1

                                                                                                                            3ca0defe21461dfd427e82722c998f370798beda

                                                                                                                            SHA256

                                                                                                                            bab8d0054758018b08969b3adf96af18056ec8c6a1fab82f4314472a49836178

                                                                                                                            SHA512

                                                                                                                            aad0fa27652af05120d5960efd727ab7570a6015638478725a7adb2b86896f26a046e6ddf0d5e7e14e928ddbe8fb39b72bb4e243919da1aa4eb9e28b04ee49f3

                                                                                                                          • C:\Program Files\Google\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            aaca0518ff60165fe38e87358e52b7eb

                                                                                                                            SHA1

                                                                                                                            3ca0defe21461dfd427e82722c998f370798beda

                                                                                                                            SHA256

                                                                                                                            bab8d0054758018b08969b3adf96af18056ec8c6a1fab82f4314472a49836178

                                                                                                                            SHA512

                                                                                                                            aad0fa27652af05120d5960efd727ab7570a6015638478725a7adb2b86896f26a046e6ddf0d5e7e14e928ddbe8fb39b72bb4e243919da1aa4eb9e28b04ee49f3

                                                                                                                          • C:\Program Files\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            91353ad97e28b582002dd409c933b858

                                                                                                                            SHA1

                                                                                                                            eb6da072d62cee3ef4a5c7d6bbb7decb7b1506f0

                                                                                                                            SHA256

                                                                                                                            429c1746c4663524eec243658642611e6f47d55fe4c307b07deeb0ddbb01fecd

                                                                                                                            SHA512

                                                                                                                            9bb93a012bf13b793e58fea8cf00bad8b843efeb2427458b21d9737e4e1d7116fa46a2669e2325320642b611eed1511cf59d32fbd29b36587fa0ac3099ed4fc3

                                                                                                                          • C:\Program Files\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            91353ad97e28b582002dd409c933b858

                                                                                                                            SHA1

                                                                                                                            eb6da072d62cee3ef4a5c7d6bbb7decb7b1506f0

                                                                                                                            SHA256

                                                                                                                            429c1746c4663524eec243658642611e6f47d55fe4c307b07deeb0ddbb01fecd

                                                                                                                            SHA512

                                                                                                                            9bb93a012bf13b793e58fea8cf00bad8b843efeb2427458b21d9737e4e1d7116fa46a2669e2325320642b611eed1511cf59d32fbd29b36587fa0ac3099ed4fc3

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2029020910\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9514d84d6e081b877b7249182d826974

                                                                                                                            SHA1

                                                                                                                            48e24409300855b8f6536a9f3caf7081aa4c2fe6

                                                                                                                            SHA256

                                                                                                                            d14131f305c0f7d1cdeeaa2dbc27ecfd11bdeb58db1bef82b82484f6462283d8

                                                                                                                            SHA512

                                                                                                                            46d03f72660246a238e08b58e7be23496ca0a227a5be84587c05076d4ca2ca405fa6387f11a8aaf720545dd063cae5343fdcb156055f2fcf5a46133657ad0500

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2029020910\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9514d84d6e081b877b7249182d826974

                                                                                                                            SHA1

                                                                                                                            48e24409300855b8f6536a9f3caf7081aa4c2fe6

                                                                                                                            SHA256

                                                                                                                            d14131f305c0f7d1cdeeaa2dbc27ecfd11bdeb58db1bef82b82484f6462283d8

                                                                                                                            SHA512

                                                                                                                            46d03f72660246a238e08b58e7be23496ca0a227a5be84587c05076d4ca2ca405fa6387f11a8aaf720545dd063cae5343fdcb156055f2fcf5a46133657ad0500

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            62127220cacd2a40b4b35de752ee8dd9

                                                                                                                            SHA1

                                                                                                                            09ae5ebb8c054250d398c3b90795b9108a571efb

                                                                                                                            SHA256

                                                                                                                            629b3874925f2e2b1e35c5430da50bb83d98983824fa9adc63e6ce5380e0fbf3

                                                                                                                            SHA512

                                                                                                                            718e0ec7e89fa6c151474cc8bf8da02ce67ae68fd805c39fec53eaf9aa3e612ea03dc9f755517a6d4f4df8570b06a003f7089a48719e451e11289e368172a4c8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            62127220cacd2a40b4b35de752ee8dd9

                                                                                                                            SHA1

                                                                                                                            09ae5ebb8c054250d398c3b90795b9108a571efb

                                                                                                                            SHA256

                                                                                                                            629b3874925f2e2b1e35c5430da50bb83d98983824fa9adc63e6ce5380e0fbf3

                                                                                                                            SHA512

                                                                                                                            718e0ec7e89fa6c151474cc8bf8da02ce67ae68fd805c39fec53eaf9aa3e612ea03dc9f755517a6d4f4df8570b06a003f7089a48719e451e11289e368172a4c8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            62127220cacd2a40b4b35de752ee8dd9

                                                                                                                            SHA1

                                                                                                                            09ae5ebb8c054250d398c3b90795b9108a571efb

                                                                                                                            SHA256

                                                                                                                            629b3874925f2e2b1e35c5430da50bb83d98983824fa9adc63e6ce5380e0fbf3

                                                                                                                            SHA512

                                                                                                                            718e0ec7e89fa6c151474cc8bf8da02ce67ae68fd805c39fec53eaf9aa3e612ea03dc9f755517a6d4f4df8570b06a003f7089a48719e451e11289e368172a4c8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            62127220cacd2a40b4b35de752ee8dd9

                                                                                                                            SHA1

                                                                                                                            09ae5ebb8c054250d398c3b90795b9108a571efb

                                                                                                                            SHA256

                                                                                                                            629b3874925f2e2b1e35c5430da50bb83d98983824fa9adc63e6ce5380e0fbf3

                                                                                                                            SHA512

                                                                                                                            718e0ec7e89fa6c151474cc8bf8da02ce67ae68fd805c39fec53eaf9aa3e612ea03dc9f755517a6d4f4df8570b06a003f7089a48719e451e11289e368172a4c8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            2e491e53c355b9bf9bee1a73559e7077

                                                                                                                            SHA1

                                                                                                                            11259346241f06434a66db464d757175de3838f1

                                                                                                                            SHA256

                                                                                                                            9e5f7476b4fae895c3eafb445cd0956523aa4ee7821bfb7df44bf626dc39e2b3

                                                                                                                            SHA512

                                                                                                                            8fd903377150808903e3f0dee3a27f96791a57ad1bc018a34386b0479660ca0e1e816c291e09329e6d5361265f8cad5f8771a1dc55171a43b4035409c9f353b5

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            2e491e53c355b9bf9bee1a73559e7077

                                                                                                                            SHA1

                                                                                                                            11259346241f06434a66db464d757175de3838f1

                                                                                                                            SHA256

                                                                                                                            9e5f7476b4fae895c3eafb445cd0956523aa4ee7821bfb7df44bf626dc39e2b3

                                                                                                                            SHA512

                                                                                                                            8fd903377150808903e3f0dee3a27f96791a57ad1bc018a34386b0479660ca0e1e816c291e09329e6d5361265f8cad5f8771a1dc55171a43b4035409c9f353b5

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9514d84d6e081b877b7249182d826974

                                                                                                                            SHA1

                                                                                                                            48e24409300855b8f6536a9f3caf7081aa4c2fe6

                                                                                                                            SHA256

                                                                                                                            d14131f305c0f7d1cdeeaa2dbc27ecfd11bdeb58db1bef82b82484f6462283d8

                                                                                                                            SHA512

                                                                                                                            46d03f72660246a238e08b58e7be23496ca0a227a5be84587c05076d4ca2ca405fa6387f11a8aaf720545dd063cae5343fdcb156055f2fcf5a46133657ad0500

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            9514d84d6e081b877b7249182d826974

                                                                                                                            SHA1

                                                                                                                            48e24409300855b8f6536a9f3caf7081aa4c2fe6

                                                                                                                            SHA256

                                                                                                                            d14131f305c0f7d1cdeeaa2dbc27ecfd11bdeb58db1bef82b82484f6462283d8

                                                                                                                            SHA512

                                                                                                                            46d03f72660246a238e08b58e7be23496ca0a227a5be84587c05076d4ca2ca405fa6387f11a8aaf720545dd063cae5343fdcb156055f2fcf5a46133657ad0500

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            62127220cacd2a40b4b35de752ee8dd9

                                                                                                                            SHA1

                                                                                                                            09ae5ebb8c054250d398c3b90795b9108a571efb

                                                                                                                            SHA256

                                                                                                                            629b3874925f2e2b1e35c5430da50bb83d98983824fa9adc63e6ce5380e0fbf3

                                                                                                                            SHA512

                                                                                                                            718e0ec7e89fa6c151474cc8bf8da02ce67ae68fd805c39fec53eaf9aa3e612ea03dc9f755517a6d4f4df8570b06a003f7089a48719e451e11289e368172a4c8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            62127220cacd2a40b4b35de752ee8dd9

                                                                                                                            SHA1

                                                                                                                            09ae5ebb8c054250d398c3b90795b9108a571efb

                                                                                                                            SHA256

                                                                                                                            629b3874925f2e2b1e35c5430da50bb83d98983824fa9adc63e6ce5380e0fbf3

                                                                                                                            SHA512

                                                                                                                            718e0ec7e89fa6c151474cc8bf8da02ce67ae68fd805c39fec53eaf9aa3e612ea03dc9f755517a6d4f4df8570b06a003f7089a48719e451e11289e368172a4c8

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            2e491e53c355b9bf9bee1a73559e7077

                                                                                                                            SHA1

                                                                                                                            11259346241f06434a66db464d757175de3838f1

                                                                                                                            SHA256

                                                                                                                            9e5f7476b4fae895c3eafb445cd0956523aa4ee7821bfb7df44bf626dc39e2b3

                                                                                                                            SHA512

                                                                                                                            8fd903377150808903e3f0dee3a27f96791a57ad1bc018a34386b0479660ca0e1e816c291e09329e6d5361265f8cad5f8771a1dc55171a43b4035409c9f353b5

                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            2e491e53c355b9bf9bee1a73559e7077

                                                                                                                            SHA1

                                                                                                                            11259346241f06434a66db464d757175de3838f1

                                                                                                                            SHA256

                                                                                                                            9e5f7476b4fae895c3eafb445cd0956523aa4ee7821bfb7df44bf626dc39e2b3

                                                                                                                            SHA512

                                                                                                                            8fd903377150808903e3f0dee3a27f96791a57ad1bc018a34386b0479660ca0e1e816c291e09329e6d5361265f8cad5f8771a1dc55171a43b4035409c9f353b5

                                                                                                                          • C:\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f3ea5f49fa9f333c79b80b556de52cbd

                                                                                                                            SHA1

                                                                                                                            64d09ddcfee069e0fe11d21415aed49e4006fb80

                                                                                                                            SHA256

                                                                                                                            e3418be3ce44e869158b6cb311989f7ae1a20285d432f7e644488b6fb6656d8c

                                                                                                                            SHA512

                                                                                                                            6d7970f414fca048001418b6d38ea4a01d20ad8ab46866774be60481539fb65387e91598edb629603c6b51e1751a84724a21cbf859b0558de04bf800184461b5

                                                                                                                          • C:\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            f3ea5f49fa9f333c79b80b556de52cbd

                                                                                                                            SHA1

                                                                                                                            64d09ddcfee069e0fe11d21415aed49e4006fb80

                                                                                                                            SHA256

                                                                                                                            e3418be3ce44e869158b6cb311989f7ae1a20285d432f7e644488b6fb6656d8c

                                                                                                                            SHA512

                                                                                                                            6d7970f414fca048001418b6d38ea4a01d20ad8ab46866774be60481539fb65387e91598edb629603c6b51e1751a84724a21cbf859b0558de04bf800184461b5

                                                                                                                          • C:\odt\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            91353ad97e28b582002dd409c933b858

                                                                                                                            SHA1

                                                                                                                            eb6da072d62cee3ef4a5c7d6bbb7decb7b1506f0

                                                                                                                            SHA256

                                                                                                                            429c1746c4663524eec243658642611e6f47d55fe4c307b07deeb0ddbb01fecd

                                                                                                                            SHA512

                                                                                                                            9bb93a012bf13b793e58fea8cf00bad8b843efeb2427458b21d9737e4e1d7116fa46a2669e2325320642b611eed1511cf59d32fbd29b36587fa0ac3099ed4fc3

                                                                                                                          • C:\odt\backup.exe

                                                                                                                            Filesize

                                                                                                                            72KB

                                                                                                                            MD5

                                                                                                                            91353ad97e28b582002dd409c933b858

                                                                                                                            SHA1

                                                                                                                            eb6da072d62cee3ef4a5c7d6bbb7decb7b1506f0

                                                                                                                            SHA256

                                                                                                                            429c1746c4663524eec243658642611e6f47d55fe4c307b07deeb0ddbb01fecd

                                                                                                                            SHA512

                                                                                                                            9bb93a012bf13b793e58fea8cf00bad8b843efeb2427458b21d9737e4e1d7116fa46a2669e2325320642b611eed1511cf59d32fbd29b36587fa0ac3099ed4fc3