Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    191s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/12/2022, 16:50

General

  • Target

    ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe

  • Size

    72KB

  • MD5

    095635a8a4d250a425c7d61c38d9c286

  • SHA1

    793ecee137fbf8b7a4ce01ce23341800a7aa932d

  • SHA256

    ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf

  • SHA512

    983b4d9060c7aef35765ad57375b3a72a4e5a16c0a13c1439e779865c3d28cabe309202bbe7999e8dbae026fc9f20030030d71ae7800e766d2937cecca22f80c

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2S:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPG

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe
    "C:\Users\Admin\AppData\Local\Temp\ae27c6ed1a4b3a3dd2ac171141a1ef89a58658c3ae8c75062652a5a0b04b84bf.exe"
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1680
    • C:\Users\Admin\AppData\Local\Temp\3982195371\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3982195371\backup.exe C:\Users\Admin\AppData\Local\Temp\3982195371\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:176
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1040
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:1904
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:4268
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1836
            • C:\Program Files\7-Zip\Lang\System Restore.exe
              "C:\Program Files\7-Zip\Lang\System Restore.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:868
          • C:\Program Files\Common Files\System Restore.exe
            "C:\Program Files\Common Files\System Restore.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:5028
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4080
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              PID:1160
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:4536
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:3412
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:4412
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1184
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2420
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1928
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1784
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2592
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2332
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2176
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1984
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  PID:404
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:396
                • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:1872
                • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                  8⤵
                  • System policy modification
                  PID:2872
                • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:3844
                • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                  8⤵
                  • Drops file in Program Files directory
                  PID:3620
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • System policy modification
                    PID:1784
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:4604
                  • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                    9⤵
                      PID:880
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      PID:3348
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                      9⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • System policy modification
                      PID:2332
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                      9⤵
                        PID:2884
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\
                        9⤵
                          PID:4064
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\
                          9⤵
                          • System policy modification
                          PID:2732
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred\
                          9⤵
                            PID:1712
                        • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                          8⤵
                          • System policy modification
                          PID:2584
                        • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:2260
                        • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • System policy modification
                          PID:5052
                        • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                          8⤵
                          • System policy modification
                          PID:2380
                        • C:\Program Files\Common Files\microsoft shared\ink\it-IT\update.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\it-IT\update.exe" C:\Program Files\Common Files\microsoft shared\ink\it-IT\
                          8⤵
                            PID:1464
                          • C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ja-JP\
                            8⤵
                            • System policy modification
                            PID:2932
                          • C:\Program Files\Common Files\microsoft shared\ink\ko-KR\data.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\ko-KR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\ko-KR\
                            8⤵
                              PID:364
                            • C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\LanguageModel\
                              8⤵
                                PID:2080
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                              7⤵
                              • Drops file in Program Files directory
                              PID:4288
                              • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                                8⤵
                                  PID:4220
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  PID:1444
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:1836
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  PID:4472
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  PID:752
                                • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  PID:5088
                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                                7⤵
                                • Disables RegEdit via registry modification
                                PID:396
                                • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                  8⤵
                                    PID:1128
                                • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                                  7⤵
                                    PID:3696
                                • C:\Program Files\Common Files\Services\backup.exe
                                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                  6⤵
                                    PID:2064
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    PID:3116
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Drops file in Program Files directory
                                      PID:2872
                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:4148
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • System policy modification
                                        PID:3272
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                          PID:4880
                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                          8⤵
                                          • System policy modification
                                          PID:4292
                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                          8⤵
                                            PID:1912
                                    • C:\Program Files\Google\backup.exe
                                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                      5⤵
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1080
                                      • C:\Program Files\Google\Chrome\backup.exe
                                        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:2108
                                        • C:\Program Files\Google\Chrome\Application\backup.exe
                                          "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                          7⤵
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1668
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                            8⤵
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:4956
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4988
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                              9⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:3620
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                              9⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:1280
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\System Restore.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1836
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                              9⤵
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1464
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4340
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:2080
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                              9⤵
                                              • Disables RegEdit via registry modification
                                              • Drops file in Program Files directory
                                              PID:3096
                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                10⤵
                                                  PID:1440
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                    11⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:1364
                                            • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                              8⤵
                                                PID:3856
                                        • C:\Program Files\Internet Explorer\backup.exe
                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          • System policy modification
                                          PID:4740
                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                            6⤵
                                            • System policy modification
                                            PID:2724
                                          • C:\Program Files\Internet Explorer\en-US\backup.exe
                                            "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:216
                                          • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                            "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • System policy modification
                                            PID:1708
                                          • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                            "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:4928
                                          • C:\Program Files\Internet Explorer\images\backup.exe
                                            "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                            6⤵
                                              PID:1980
                                            • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                              "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • System policy modification
                                              PID:4272
                                            • C:\Program Files\Internet Explorer\ja-JP\System Restore.exe
                                              "C:\Program Files\Internet Explorer\ja-JP\System Restore.exe" C:\Program Files\Internet Explorer\ja-JP\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              PID:3596
                                            • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                              "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                              6⤵
                                                PID:2588
                                            • C:\Program Files\Java\backup.exe
                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                              5⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Drops file in Program Files directory
                                              • System policy modification
                                              PID:4016
                                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                6⤵
                                                • Drops file in Program Files directory
                                                PID:2612
                                                • C:\Program Files\Java\jdk1.8.0_66\db\data.exe
                                                  "C:\Program Files\Java\jdk1.8.0_66\db\data.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                  7⤵
                                                    PID:2608
                                                    • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                      "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                      8⤵
                                                        PID:2436
                                                      • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                        8⤵
                                                          PID:3684
                                                      • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        PID:4588
                                                      • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                        7⤵
                                                        • System policy modification
                                                        PID:3836
                                                        • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                          8⤵
                                                          • System policy modification
                                                          PID:5048
                                                          • C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\
                                                            9⤵
                                                              PID:868
                                                        • C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\jre\backup.exe" C:\Program Files\Java\jdk1.8.0_66\jre\
                                                          7⤵
                                                            PID:672
                                                        • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                          "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                          6⤵
                                                            PID:4216
                                                        • C:\Program Files\Microsoft Office\backup.exe
                                                          "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                          5⤵
                                                            PID:3492
                                                        • C:\Program Files (x86)\backup.exe
                                                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                          4⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1972
                                                          • C:\Program Files (x86)\Adobe\backup.exe
                                                            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                            5⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4472
                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:2248
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                7⤵
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4420
                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                7⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Program Files directory
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:4716
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • System policy modification
                                                                  PID:4336
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                    9⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • System policy modification
                                                                    PID:1484
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4736
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4752
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                  8⤵
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:2724
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:3744
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                  8⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • System policy modification
                                                                  PID:4448
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                    9⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • System policy modification
                                                                    PID:2096
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Drops file in Program Files directory
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  • System policy modification
                                                                  PID:2492
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                    9⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    PID:216
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  PID:4528
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Disables RegEdit via registry modification
                                                                  PID:4412
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                    9⤵
                                                                    • Disables RegEdit via registry modification
                                                                    PID:4996
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Drops file in Program Files directory
                                                                  PID:3184
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\
                                                                    9⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • System policy modification
                                                                    PID:1760
                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\
                                                                  8⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  PID:3092
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\
                                                                    9⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • System policy modification
                                                                    PID:928
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\PMP\
                                                                      10⤵
                                                                      • System policy modification
                                                                      PID:1200
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\
                                                                    9⤵
                                                                    • Disables RegEdit via registry modification
                                                                    • System policy modification
                                                                    PID:4752
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\
                                                                      10⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:4892
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                        11⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • System policy modification
                                                                        PID:3656
                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\
                                                                    9⤵
                                                                      PID:3480
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\data.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\
                                                                        10⤵
                                                                          PID:1184
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\
                                                                      8⤵
                                                                        PID:2576
                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:4080
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                        8⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        PID:1872
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\update.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\update.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                          9⤵
                                                                          • System policy modification
                                                                          PID:4708
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                        8⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        PID:4284
                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                        8⤵
                                                                        • Drops file in Program Files directory
                                                                        PID:2796
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                          9⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Drops file in Program Files directory
                                                                          PID:4420
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\System Restore.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                            10⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:3960
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\
                                                                            10⤵
                                                                              PID:4060
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\
                                                                                11⤵
                                                                                  PID:2756
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                          7⤵
                                                                            PID:1904
                                                                      • C:\Program Files (x86)\Common Files\backup.exe
                                                                        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Drops file in Program Files directory
                                                                        PID:792
                                                                        • C:\Program Files (x86)\Common Files\Adobe\update.exe
                                                                          "C:\Program Files (x86)\Common Files\Adobe\update.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                          6⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          • System policy modification
                                                                          PID:3128
                                                                          • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:3140
                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            PID:812
                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:4704
                                                                          • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\data.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\data.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                            7⤵
                                                                            • Drops file in Program Files directory
                                                                            PID:4400
                                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe
                                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:4540
                                                                          • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                            "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                            7⤵
                                                                              PID:4544
                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                8⤵
                                                                                  PID:3444
                                                                            • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                              "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                              6⤵
                                                                                PID:1892
                                                                            • C:\Program Files (x86)\Google\backup.exe
                                                                              "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                              5⤵
                                                                              • Drops file in Program Files directory
                                                                              PID:3540
                                                                              • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                6⤵
                                                                                  PID:2024
                                                                            • C:\Users\backup.exe
                                                                              C:\Users\backup.exe C:\Users\
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • Suspicious use of WriteProcessMemory
                                                                              • System policy modification
                                                                              PID:3880
                                                                              • C:\Users\Admin\backup.exe
                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                5⤵
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:4708
                                                                                • C:\Users\Admin\3D Objects\update.exe
                                                                                  "C:\Users\Admin\3D Objects\update.exe" C:\Users\Admin\3D Objects\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:4528
                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3116
                                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4984
                                                                                • C:\Users\Admin\Documents\backup.exe
                                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                  6⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:5064
                                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4144
                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4240
                                                                                • C:\Users\Admin\Links\backup.exe
                                                                                  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                  6⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2436
                                                                                • C:\Users\Admin\Music\backup.exe
                                                                                  C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                  6⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:3176
                                                                                • C:\Users\Admin\OneDrive\backup.exe
                                                                                  C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                  6⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1288
                                                                                • C:\Users\Admin\Pictures\backup.exe
                                                                                  C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                  6⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2732
                                                                                  • C:\Users\Admin\Pictures\Camera Roll\data.exe
                                                                                    "C:\Users\Admin\Pictures\Camera Roll\data.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                    7⤵
                                                                                    • Executes dropped EXE
                                                                                    PID:1012
                                                                                  • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                    "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                    7⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    PID:3128
                                                                                • C:\Users\Admin\Saved Games\System Restore.exe
                                                                                  "C:\Users\Admin\Saved Games\System Restore.exe" C:\Users\Admin\Saved Games\
                                                                                  6⤵
                                                                                    PID:2472
                                                                                  • C:\Users\Admin\Searches\backup.exe
                                                                                    C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:3508
                                                                                  • C:\Users\Admin\Videos\backup.exe
                                                                                    C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    • System policy modification
                                                                                    PID:2420
                                                                                • C:\Users\Public\backup.exe
                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                  5⤵
                                                                                    PID:1928
                                                                                    • C:\Users\Public\Documents\backup.exe
                                                                                      C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                      6⤵
                                                                                      • System policy modification
                                                                                      PID:2460
                                                                                    • C:\Users\Public\Downloads\backup.exe
                                                                                      C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                      6⤵
                                                                                      • System policy modification
                                                                                      PID:3656
                                                                                    • C:\Users\Public\Music\backup.exe
                                                                                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                      6⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:628
                                                                                    • C:\Users\Public\Pictures\backup.exe
                                                                                      C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                      6⤵
                                                                                      • System policy modification
                                                                                      PID:4660
                                                                                    • C:\Users\Public\Videos\backup.exe
                                                                                      C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                      6⤵
                                                                                      • System policy modification
                                                                                      PID:4168
                                                                                • C:\Windows\backup.exe
                                                                                  C:\Windows\backup.exe C:\Windows\
                                                                                  4⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Windows directory
                                                                                  PID:4556
                                                                                  • C:\Windows\addins\backup.exe
                                                                                    C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                    5⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    PID:1388
                                                                                  • C:\Windows\appcompat\backup.exe
                                                                                    C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                    5⤵
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Windows directory
                                                                                    PID:4092
                                                                                    • C:\Windows\appcompat\appraiser\backup.exe
                                                                                      C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                      6⤵
                                                                                      • Drops file in Windows directory
                                                                                      • System policy modification
                                                                                      PID:5032
                                                                                      • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                        C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                        7⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        PID:724
                                                                                    • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                      C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                      6⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:2096
                                                                                    • C:\Windows\appcompat\Programs\backup.exe
                                                                                      C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                      6⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      PID:3472
                                                                                  • C:\Windows\apppatch\backup.exe
                                                                                    C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                    5⤵
                                                                                      PID:5100
                                                                                      • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                        C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                        6⤵
                                                                                          PID:4928
                                                                                • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3744
                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:3444
                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3360
                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3552
                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                  2⤵
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:3408
                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                  2⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2884

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v6

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\PerfLogs\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                aef65d5e76699ea1e2fca8017abf35f0

                                                                                SHA1

                                                                                6a247009d474ff590da6f2275d02a01c5959551b

                                                                                SHA256

                                                                                81b753076ea3819a44e0b1113322fe9b5336b180ed95fb95530cecb0c5dce7e9

                                                                                SHA512

                                                                                06a4c119c4b24ed47a855cf4d44a25705333caa2005524ee2e4d6296757688ece172d0bc6c069cf6180a154eccbd6c4f75cf305adc42631c514244545b01ff6b

                                                                              • C:\PerfLogs\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                aef65d5e76699ea1e2fca8017abf35f0

                                                                                SHA1

                                                                                6a247009d474ff590da6f2275d02a01c5959551b

                                                                                SHA256

                                                                                81b753076ea3819a44e0b1113322fe9b5336b180ed95fb95530cecb0c5dce7e9

                                                                                SHA512

                                                                                06a4c119c4b24ed47a855cf4d44a25705333caa2005524ee2e4d6296757688ece172d0bc6c069cf6180a154eccbd6c4f75cf305adc42631c514244545b01ff6b

                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                2c6f9b710ee7c0724a90c0a9a12175c7

                                                                                SHA1

                                                                                6d6d1a7d6e0f71ef674063bc976f645cc9776a61

                                                                                SHA256

                                                                                89196ee84fc66d025577a9ab0c95f4ea322fddbd476a31fc2d566f439201ee2f

                                                                                SHA512

                                                                                ce7b640a030919f3ab4ec66f1ee1cf48fc01a60e924add0017f6fc081015b5f15986267fff8aa6f7fbd68575da95186ec525a87fc1ef540249aa9b2f9b42c74d

                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                2c6f9b710ee7c0724a90c0a9a12175c7

                                                                                SHA1

                                                                                6d6d1a7d6e0f71ef674063bc976f645cc9776a61

                                                                                SHA256

                                                                                89196ee84fc66d025577a9ab0c95f4ea322fddbd476a31fc2d566f439201ee2f

                                                                                SHA512

                                                                                ce7b640a030919f3ab4ec66f1ee1cf48fc01a60e924add0017f6fc081015b5f15986267fff8aa6f7fbd68575da95186ec525a87fc1ef540249aa9b2f9b42c74d

                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                5cfb22190abcafc3ecd39d0a842ac8eb

                                                                                SHA1

                                                                                7169109f1c26e332e31684606d8a65c27d574cb0

                                                                                SHA256

                                                                                29705d074e7772a66513b2129b16027c78815bfaee9b3aff01bc58f686aec702

                                                                                SHA512

                                                                                c047d37ca17718ec54c9b5c0095b9f938dc6381ae9abc1da9b87e92855556a77d4ddb09fe9193b5c2e46ba5df5c553036620223faadb08fbd9d48ccd82e9f801

                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                5cfb22190abcafc3ecd39d0a842ac8eb

                                                                                SHA1

                                                                                7169109f1c26e332e31684606d8a65c27d574cb0

                                                                                SHA256

                                                                                29705d074e7772a66513b2129b16027c78815bfaee9b3aff01bc58f686aec702

                                                                                SHA512

                                                                                c047d37ca17718ec54c9b5c0095b9f938dc6381ae9abc1da9b87e92855556a77d4ddb09fe9193b5c2e46ba5df5c553036620223faadb08fbd9d48ccd82e9f801

                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                4935331be460a68310fa0ad89b9c4e75

                                                                                SHA1

                                                                                f843914c66d9ba6f343d57651cc31c052fd85937

                                                                                SHA256

                                                                                d4e8a9f207d636f0eda0b22fe15da0e12463d60e09a5f71f883c697c836b86f1

                                                                                SHA512

                                                                                226201e2ad74cc6e1841f21e576f2e9a616649dda5ec51ea96e3951655133b7f32dd1a5b29aa0e80facb60cc8074a36efae52edbd4b185401fd4b202bb2159bb

                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                4935331be460a68310fa0ad89b9c4e75

                                                                                SHA1

                                                                                f843914c66d9ba6f343d57651cc31c052fd85937

                                                                                SHA256

                                                                                d4e8a9f207d636f0eda0b22fe15da0e12463d60e09a5f71f883c697c836b86f1

                                                                                SHA512

                                                                                226201e2ad74cc6e1841f21e576f2e9a616649dda5ec51ea96e3951655133b7f32dd1a5b29aa0e80facb60cc8074a36efae52edbd4b185401fd4b202bb2159bb

                                                                              • C:\Program Files (x86)\Adobe\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                ac0e1d1ef22e03f35d385bac16b603d3

                                                                                SHA1

                                                                                9564574990952fe8ef75f8e4855d191118b08f71

                                                                                SHA256

                                                                                c430140b7a924a89caf149273bbf43845c89f1311ff76ef8c93702492af8fd22

                                                                                SHA512

                                                                                01e6c90c2b1ae9c722231d458a9cb04fd8aad88c0a288845da8aad858a79f6783cd44947e1cf90a10259e1b0b6b2c19a6b92ba013ecdf5929cd07904a67286ab

                                                                              • C:\Program Files (x86)\Adobe\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                ac0e1d1ef22e03f35d385bac16b603d3

                                                                                SHA1

                                                                                9564574990952fe8ef75f8e4855d191118b08f71

                                                                                SHA256

                                                                                c430140b7a924a89caf149273bbf43845c89f1311ff76ef8c93702492af8fd22

                                                                                SHA512

                                                                                01e6c90c2b1ae9c722231d458a9cb04fd8aad88c0a288845da8aad858a79f6783cd44947e1cf90a10259e1b0b6b2c19a6b92ba013ecdf5929cd07904a67286ab

                                                                              • C:\Program Files (x86)\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                02e487cc48abf49d601f95d6f4aba220

                                                                                SHA1

                                                                                70b69d5c859cafa90a3feec39b394515828db96c

                                                                                SHA256

                                                                                09870b0778c8a1c5f7bc8e4866ace9377f01ef16feac38ca3a0313fdbcf841b4

                                                                                SHA512

                                                                                389792e212900ae0dc13ffd384f2f4d0334be931af5f65091b59f1cbed74050358e0e05fdf90c1f4c084d32f1386518fe50b78cf3de5adc38b93077e3aaadd5d

                                                                              • C:\Program Files (x86)\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                02e487cc48abf49d601f95d6f4aba220

                                                                                SHA1

                                                                                70b69d5c859cafa90a3feec39b394515828db96c

                                                                                SHA256

                                                                                09870b0778c8a1c5f7bc8e4866ace9377f01ef16feac38ca3a0313fdbcf841b4

                                                                                SHA512

                                                                                389792e212900ae0dc13ffd384f2f4d0334be931af5f65091b59f1cbed74050358e0e05fdf90c1f4c084d32f1386518fe50b78cf3de5adc38b93077e3aaadd5d

                                                                              • C:\Program Files\7-Zip\Lang\System Restore.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                9fd5bb37928c19aa093991246c548e81

                                                                                SHA1

                                                                                c10d1536659b1c8a0f347110a8b6c2b5ca3a477d

                                                                                SHA256

                                                                                2c5f38bfe57ae4d99143f62239bb81d6f06e627cfa1c49138aebdde200cb6b6f

                                                                                SHA512

                                                                                d6197f52dd4bf08d2c0eaa65769b61c87def8b8a6db4dfb442dd09e61293cbcd43de23f7a3479c230773c0ac7ecabac20fef5297ad1fa44194ed4dc0301041c2

                                                                              • C:\Program Files\7-Zip\Lang\System Restore.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                9fd5bb37928c19aa093991246c548e81

                                                                                SHA1

                                                                                c10d1536659b1c8a0f347110a8b6c2b5ca3a477d

                                                                                SHA256

                                                                                2c5f38bfe57ae4d99143f62239bb81d6f06e627cfa1c49138aebdde200cb6b6f

                                                                                SHA512

                                                                                d6197f52dd4bf08d2c0eaa65769b61c87def8b8a6db4dfb442dd09e61293cbcd43de23f7a3479c230773c0ac7ecabac20fef5297ad1fa44194ed4dc0301041c2

                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                d05b39782cd8aee2c69e0c9f964124a8

                                                                                SHA1

                                                                                91aeacedb61bafe924633f93ef43cb77b7960a3d

                                                                                SHA256

                                                                                178895c1548abcdc623319570b2548325e4fe5a2a96ef1656809c6ba5b46c26e

                                                                                SHA512

                                                                                994def19b77da83e4a1d08b485e1e9e2fa837a2c9b447d344716586d25d37f59988f23cebf96d720dbf659edfd08ba6cf8aaf73b241881483a95b3dc9f775337

                                                                              • C:\Program Files\7-Zip\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                d05b39782cd8aee2c69e0c9f964124a8

                                                                                SHA1

                                                                                91aeacedb61bafe924633f93ef43cb77b7960a3d

                                                                                SHA256

                                                                                178895c1548abcdc623319570b2548325e4fe5a2a96ef1656809c6ba5b46c26e

                                                                                SHA512

                                                                                994def19b77da83e4a1d08b485e1e9e2fa837a2c9b447d344716586d25d37f59988f23cebf96d720dbf659edfd08ba6cf8aaf73b241881483a95b3dc9f775337

                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                f840560bbc9598195b21b30d6c8a9ddb

                                                                                SHA1

                                                                                23ace1b57af00bf225fd3fca273000404b44c85c

                                                                                SHA256

                                                                                972937e49e76dcd72ef78afcdf81d69b7b6884da38428a2b2caeb90c7563d021

                                                                                SHA512

                                                                                b36baf22834cc840810e018268e84c5c3ea7fb4b575d134fc6cd51ada4b2dd9f2a962bf9f576bf7333710f91fe48b7930dbd4b0b8e5fa48e74c450676652f6eb

                                                                              • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                f840560bbc9598195b21b30d6c8a9ddb

                                                                                SHA1

                                                                                23ace1b57af00bf225fd3fca273000404b44c85c

                                                                                SHA256

                                                                                972937e49e76dcd72ef78afcdf81d69b7b6884da38428a2b2caeb90c7563d021

                                                                                SHA512

                                                                                b36baf22834cc840810e018268e84c5c3ea7fb4b575d134fc6cd51ada4b2dd9f2a962bf9f576bf7333710f91fe48b7930dbd4b0b8e5fa48e74c450676652f6eb

                                                                              • C:\Program Files\Common Files\System Restore.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                5a43b5025ae86424bc892c78f96c46c3

                                                                                SHA1

                                                                                9deda2360d1cd1771c7255a457e6071ea5bc1c61

                                                                                SHA256

                                                                                e457711c726aa057acab73e472e311bdcbb1ce50f7b96de5c6459bb5d75a3643

                                                                                SHA512

                                                                                ce6746d4649c2da33a1830ad1562f61e48a0a4b23851e6815592d4b375d23c657eef920e993b8da1c0c3e2d32ef81bd2f584af22fb4d8ceecc76160b5930b5bb

                                                                              • C:\Program Files\Common Files\System Restore.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                5a43b5025ae86424bc892c78f96c46c3

                                                                                SHA1

                                                                                9deda2360d1cd1771c7255a457e6071ea5bc1c61

                                                                                SHA256

                                                                                e457711c726aa057acab73e472e311bdcbb1ce50f7b96de5c6459bb5d75a3643

                                                                                SHA512

                                                                                ce6746d4649c2da33a1830ad1562f61e48a0a4b23851e6815592d4b375d23c657eef920e993b8da1c0c3e2d32ef81bd2f584af22fb4d8ceecc76160b5930b5bb

                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1ee2e15c931faedbb70906882c24e375

                                                                                SHA1

                                                                                d655444406809b86e9b517b034400fc7e505c7cd

                                                                                SHA256

                                                                                062a574ddc75104637e4c4ae8fd6d61f3607c82abd3d8ea8e1d5e5c456f30b98

                                                                                SHA512

                                                                                d3b75e192fd672476b258afe44440013241aba4279d31b8ab242f9f588fe1280e60cc72989bea0d5bf00149c4500bd33527b6d95210df696d0fb5bba3f9d46ef

                                                                              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1ee2e15c931faedbb70906882c24e375

                                                                                SHA1

                                                                                d655444406809b86e9b517b034400fc7e505c7cd

                                                                                SHA256

                                                                                062a574ddc75104637e4c4ae8fd6d61f3607c82abd3d8ea8e1d5e5c456f30b98

                                                                                SHA512

                                                                                d3b75e192fd672476b258afe44440013241aba4279d31b8ab242f9f588fe1280e60cc72989bea0d5bf00149c4500bd33527b6d95210df696d0fb5bba3f9d46ef

                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                cc1a88dc5fd6fa30559fdb8bcbd48801

                                                                                SHA1

                                                                                ca4c8acf07c2c8d7f3c23b525f880496712615bb

                                                                                SHA256

                                                                                5488924850391be9acacfd647b090f6c4305129855a72f1dc39d1461d5b9f05f

                                                                                SHA512

                                                                                d623b2a3c9f1b83393ac2c7cf638705044c154b6c3bfec8093acbd0fa566dcc72e9db45be6f0163a223935842598539c0b295b6d427cbbd8d2fb18d7874e50e2

                                                                              • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                cc1a88dc5fd6fa30559fdb8bcbd48801

                                                                                SHA1

                                                                                ca4c8acf07c2c8d7f3c23b525f880496712615bb

                                                                                SHA256

                                                                                5488924850391be9acacfd647b090f6c4305129855a72f1dc39d1461d5b9f05f

                                                                                SHA512

                                                                                d623b2a3c9f1b83393ac2c7cf638705044c154b6c3bfec8093acbd0fa566dcc72e9db45be6f0163a223935842598539c0b295b6d427cbbd8d2fb18d7874e50e2

                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                e7c83a4c740e501c8b26abb6bbd983c3

                                                                                SHA1

                                                                                d4c83061861cb89343c98f18cda7325d44615664

                                                                                SHA256

                                                                                732eddf2c1b6fda2716c3a1e6a5d71ecfb74759ddf93a1dd99d76a295fdbcb18

                                                                                SHA512

                                                                                6b4122ce6b2020067f12bea9cabcfbfa7aa8d11dddc53f99cc36fb6e05558eede4a97de577a94ec2367d9225a9ac2f1e222302c13ad3d90068e5b752e0b06f0d

                                                                              • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                e7c83a4c740e501c8b26abb6bbd983c3

                                                                                SHA1

                                                                                d4c83061861cb89343c98f18cda7325d44615664

                                                                                SHA256

                                                                                732eddf2c1b6fda2716c3a1e6a5d71ecfb74759ddf93a1dd99d76a295fdbcb18

                                                                                SHA512

                                                                                6b4122ce6b2020067f12bea9cabcfbfa7aa8d11dddc53f99cc36fb6e05558eede4a97de577a94ec2367d9225a9ac2f1e222302c13ad3d90068e5b752e0b06f0d

                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                4a1099b32caa67be93bec95c096861b1

                                                                                SHA1

                                                                                18b499fb271c42ee7ea0c7d30f389865a1b8f915

                                                                                SHA256

                                                                                98c67e35acc120e3bae7ae37470ec34300e2a02098b5b3ec75abad5bf008629b

                                                                                SHA512

                                                                                e2bd4a758becafe945ed4404017f8e477dc1d35236ac98fc88f6160cbb7e3662aedeea53d918ade91b865c4f02e1ffd728607e0ce41c599f9c474b2cb2daadb1

                                                                              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                4a1099b32caa67be93bec95c096861b1

                                                                                SHA1

                                                                                18b499fb271c42ee7ea0c7d30f389865a1b8f915

                                                                                SHA256

                                                                                98c67e35acc120e3bae7ae37470ec34300e2a02098b5b3ec75abad5bf008629b

                                                                                SHA512

                                                                                e2bd4a758becafe945ed4404017f8e477dc1d35236ac98fc88f6160cbb7e3662aedeea53d918ade91b865c4f02e1ffd728607e0ce41c599f9c474b2cb2daadb1

                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                7c2354c9a62b2c0d9d96dda9924a3655

                                                                                SHA1

                                                                                a262ba83f3c5ed1a1386d228105a983e64b6bd38

                                                                                SHA256

                                                                                e583091481bbca72ff359ffaa8474c432d81fc86635c901070fd781d8519106d

                                                                                SHA512

                                                                                54afeb665a5f5ae4c09df69b9489bb34ed1bf3aa42769038e99ca3bbfdc02716dd5649648dcba754f7b1069f5f0ba8f8701ec63d24b74e0d53851d0d091e13fc

                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                7c2354c9a62b2c0d9d96dda9924a3655

                                                                                SHA1

                                                                                a262ba83f3c5ed1a1386d228105a983e64b6bd38

                                                                                SHA256

                                                                                e583091481bbca72ff359ffaa8474c432d81fc86635c901070fd781d8519106d

                                                                                SHA512

                                                                                54afeb665a5f5ae4c09df69b9489bb34ed1bf3aa42769038e99ca3bbfdc02716dd5649648dcba754f7b1069f5f0ba8f8701ec63d24b74e0d53851d0d091e13fc

                                                                              • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                49afe4b11595021c93f06d4cd91c3274

                                                                                SHA1

                                                                                d0a321de0ad31a084af964913730267c33f38fa0

                                                                                SHA256

                                                                                89835fb103042a5f3e107e52ddced1c982d7d326dde3fe0896509b707008419d

                                                                                SHA512

                                                                                c4e59805671de314c46c0b3366c06a6f73b7baeeaedd671c9ff0ce5218386bcf5f202fa0839da7605b21a154550d8fd67a0ed3a38682b000422acceb5920ff80

                                                                              • C:\Program Files\Google\Chrome\Application\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                49afe4b11595021c93f06d4cd91c3274

                                                                                SHA1

                                                                                d0a321de0ad31a084af964913730267c33f38fa0

                                                                                SHA256

                                                                                89835fb103042a5f3e107e52ddced1c982d7d326dde3fe0896509b707008419d

                                                                                SHA512

                                                                                c4e59805671de314c46c0b3366c06a6f73b7baeeaedd671c9ff0ce5218386bcf5f202fa0839da7605b21a154550d8fd67a0ed3a38682b000422acceb5920ff80

                                                                              • C:\Program Files\Google\Chrome\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                0a6aa73808cf3e230b8f753bed29c094

                                                                                SHA1

                                                                                f713162d3ab0ca5e3f1fb11b8882907b5f60aa96

                                                                                SHA256

                                                                                a61efced17458136bb6326ed5d3d758bf3e33575abed6a1bfdc9f67f78aafa9b

                                                                                SHA512

                                                                                3a7b20dd45a02e1c2d5a11009e4d4c7f594e1cac66f70310aa17f9cd7b48a77bb484db9c60df3bea64a09ef9436f99207cf5bd1e2873cc71f806c7eebd1dbf9f

                                                                              • C:\Program Files\Google\Chrome\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                0a6aa73808cf3e230b8f753bed29c094

                                                                                SHA1

                                                                                f713162d3ab0ca5e3f1fb11b8882907b5f60aa96

                                                                                SHA256

                                                                                a61efced17458136bb6326ed5d3d758bf3e33575abed6a1bfdc9f67f78aafa9b

                                                                                SHA512

                                                                                3a7b20dd45a02e1c2d5a11009e4d4c7f594e1cac66f70310aa17f9cd7b48a77bb484db9c60df3bea64a09ef9436f99207cf5bd1e2873cc71f806c7eebd1dbf9f

                                                                              • C:\Program Files\Google\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                13dcd3c665a38cd767a649c75eb35c9c

                                                                                SHA1

                                                                                673d57d2e37d7328bbfc2f6e8736bc5c61ce9a6d

                                                                                SHA256

                                                                                e3292536900f0f9d82f94c5f02a546ea56f676c81c6a5cf03e8eee53caf33751

                                                                                SHA512

                                                                                d70c5205d0e9c92f735f596d6a708bd63cc917e5cfafc0833a97f84a1a0e37c2bdd53078bb911e3be348b1ce6e5d53fcf038f6edc2ccf3bec37c14fc002c5a25

                                                                              • C:\Program Files\Google\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                13dcd3c665a38cd767a649c75eb35c9c

                                                                                SHA1

                                                                                673d57d2e37d7328bbfc2f6e8736bc5c61ce9a6d

                                                                                SHA256

                                                                                e3292536900f0f9d82f94c5f02a546ea56f676c81c6a5cf03e8eee53caf33751

                                                                                SHA512

                                                                                d70c5205d0e9c92f735f596d6a708bd63cc917e5cfafc0833a97f84a1a0e37c2bdd53078bb911e3be348b1ce6e5d53fcf038f6edc2ccf3bec37c14fc002c5a25

                                                                              • C:\Program Files\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                aef65d5e76699ea1e2fca8017abf35f0

                                                                                SHA1

                                                                                6a247009d474ff590da6f2275d02a01c5959551b

                                                                                SHA256

                                                                                81b753076ea3819a44e0b1113322fe9b5336b180ed95fb95530cecb0c5dce7e9

                                                                                SHA512

                                                                                06a4c119c4b24ed47a855cf4d44a25705333caa2005524ee2e4d6296757688ece172d0bc6c069cf6180a154eccbd6c4f75cf305adc42631c514244545b01ff6b

                                                                              • C:\Program Files\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                aef65d5e76699ea1e2fca8017abf35f0

                                                                                SHA1

                                                                                6a247009d474ff590da6f2275d02a01c5959551b

                                                                                SHA256

                                                                                81b753076ea3819a44e0b1113322fe9b5336b180ed95fb95530cecb0c5dce7e9

                                                                                SHA512

                                                                                06a4c119c4b24ed47a855cf4d44a25705333caa2005524ee2e4d6296757688ece172d0bc6c069cf6180a154eccbd6c4f75cf305adc42631c514244545b01ff6b

                                                                              • C:\Users\Admin\3D Objects\update.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                d6586679e098d74be940c311a858a610

                                                                                SHA1

                                                                                3985d65b0152a3457ba5e398c330b2c44468e42b

                                                                                SHA256

                                                                                70dfba61e05db4c339096b46eaadf627767675eefe0e854fcd77281225f726ed

                                                                                SHA512

                                                                                1ef083c2c21df48f3d3f135f39307fefa0c309b8ce2a00afced41eeae7fad5556588773eb3e9607163de1d19f12b0a5aa189a6b16278f7d346c5a8b57b67a9fa

                                                                              • C:\Users\Admin\3D Objects\update.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                d6586679e098d74be940c311a858a610

                                                                                SHA1

                                                                                3985d65b0152a3457ba5e398c330b2c44468e42b

                                                                                SHA256

                                                                                70dfba61e05db4c339096b46eaadf627767675eefe0e854fcd77281225f726ed

                                                                                SHA512

                                                                                1ef083c2c21df48f3d3f135f39307fefa0c309b8ce2a00afced41eeae7fad5556588773eb3e9607163de1d19f12b0a5aa189a6b16278f7d346c5a8b57b67a9fa

                                                                              • C:\Users\Admin\AppData\Local\Temp\3982195371\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                da50228e9a1da8af4b0511ac8b03941a

                                                                                SHA1

                                                                                47b04c153774bbddc23448a2298fd7c3496aac94

                                                                                SHA256

                                                                                714f45c88faa1571528908182f94a1289ac8585341f9f457af173251c938d20a

                                                                                SHA512

                                                                                c7d2b14502ac684135f51b9c395f1d1dcaea6cb1e2dc32be5a45b7dd28a3eb89b9939860500a75b0df0b24169fbe142d6b2cf747dd33f10b76eeb6a609573a6a

                                                                              • C:\Users\Admin\AppData\Local\Temp\3982195371\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                da50228e9a1da8af4b0511ac8b03941a

                                                                                SHA1

                                                                                47b04c153774bbddc23448a2298fd7c3496aac94

                                                                                SHA256

                                                                                714f45c88faa1571528908182f94a1289ac8585341f9f457af173251c938d20a

                                                                                SHA512

                                                                                c7d2b14502ac684135f51b9c395f1d1dcaea6cb1e2dc32be5a45b7dd28a3eb89b9939860500a75b0df0b24169fbe142d6b2cf747dd33f10b76eeb6a609573a6a

                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                3f5249cd748f2ea64e6d0baf607469a7

                                                                                SHA1

                                                                                70454dc35e532529ecb5dbb0fd96e8f750c16dcb

                                                                                SHA256

                                                                                f12b9883dea691e1d46323f0c48ec0740db02c073fa69830bff2ef3149f55f3f

                                                                                SHA512

                                                                                4b2593cb04e6c94bc77df3910a4fa587bea742915ea3067ecbd89866fe82e0861225a6481a6c1bed37b8e0b31be4290432bdcbec3a003245fb768815f7cf50e8

                                                                              • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                3f5249cd748f2ea64e6d0baf607469a7

                                                                                SHA1

                                                                                70454dc35e532529ecb5dbb0fd96e8f750c16dcb

                                                                                SHA256

                                                                                f12b9883dea691e1d46323f0c48ec0740db02c073fa69830bff2ef3149f55f3f

                                                                                SHA512

                                                                                4b2593cb04e6c94bc77df3910a4fa587bea742915ea3067ecbd89866fe82e0861225a6481a6c1bed37b8e0b31be4290432bdcbec3a003245fb768815f7cf50e8

                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                3f5249cd748f2ea64e6d0baf607469a7

                                                                                SHA1

                                                                                70454dc35e532529ecb5dbb0fd96e8f750c16dcb

                                                                                SHA256

                                                                                f12b9883dea691e1d46323f0c48ec0740db02c073fa69830bff2ef3149f55f3f

                                                                                SHA512

                                                                                4b2593cb04e6c94bc77df3910a4fa587bea742915ea3067ecbd89866fe82e0861225a6481a6c1bed37b8e0b31be4290432bdcbec3a003245fb768815f7cf50e8

                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                3f5249cd748f2ea64e6d0baf607469a7

                                                                                SHA1

                                                                                70454dc35e532529ecb5dbb0fd96e8f750c16dcb

                                                                                SHA256

                                                                                f12b9883dea691e1d46323f0c48ec0740db02c073fa69830bff2ef3149f55f3f

                                                                                SHA512

                                                                                4b2593cb04e6c94bc77df3910a4fa587bea742915ea3067ecbd89866fe82e0861225a6481a6c1bed37b8e0b31be4290432bdcbec3a003245fb768815f7cf50e8

                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                1e79cecb6b743dbb96b0a9a2a71c62d7

                                                                                SHA1

                                                                                8d4007f0ac42fe16ddbf32b4e6eeda190152b736

                                                                                SHA256

                                                                                f2497434fc1b7b6eb33c03205ac6834ed9af177d17614f304c03930804a30948

                                                                                SHA512

                                                                                8b68d1028b697222d456a0ecae71e430a6bac52868107ef96abee7d51f74e3d840d32b494c62ffac95afddb4ad9ebd787bbddc55c3da0258720d0d8981381b38

                                                                              • C:\Users\Admin\Contacts\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                d8285e0a6d7c3c471fa83cab08b9459b

                                                                                SHA1

                                                                                835741ad429420e95c425841616448a34b0f1b26

                                                                                SHA256

                                                                                277daf6d81fbec1e08a7e6a54713c1c665988c13a0ace7e34a83156166436653

                                                                                SHA512

                                                                                298b9048ef7d166e8b155cffd908067e23660d4f3a6c8d1154c967a891dd4ac3de5559a24f0afa8244e6f3d0987b2b48a591ba37c96d5d24e31f467754bf0cba

                                                                              • C:\Users\Admin\Contacts\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                d8285e0a6d7c3c471fa83cab08b9459b

                                                                                SHA1

                                                                                835741ad429420e95c425841616448a34b0f1b26

                                                                                SHA256

                                                                                277daf6d81fbec1e08a7e6a54713c1c665988c13a0ace7e34a83156166436653

                                                                                SHA512

                                                                                298b9048ef7d166e8b155cffd908067e23660d4f3a6c8d1154c967a891dd4ac3de5559a24f0afa8244e6f3d0987b2b48a591ba37c96d5d24e31f467754bf0cba

                                                                              • C:\Users\Admin\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                e3ffa4b8e0c3e3e20fdb50d2381991d8

                                                                                SHA1

                                                                                fb484d87dffa52f7ab3a1544d9dd73af0d580f44

                                                                                SHA256

                                                                                906316f593f3fedb5552052091dfd86cda18d0f623823fa659b7e87fe6b71ea8

                                                                                SHA512

                                                                                b3c87ee5be5e3d8b68633ecc5198d0afb40567d38ab616de319c00f00f644f18e2ea34ec2a776d3574fdd08c6225e7045226b3a87198b3ed09c18f8bd36c6e5a

                                                                              • C:\Users\Admin\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                e3ffa4b8e0c3e3e20fdb50d2381991d8

                                                                                SHA1

                                                                                fb484d87dffa52f7ab3a1544d9dd73af0d580f44

                                                                                SHA256

                                                                                906316f593f3fedb5552052091dfd86cda18d0f623823fa659b7e87fe6b71ea8

                                                                                SHA512

                                                                                b3c87ee5be5e3d8b68633ecc5198d0afb40567d38ab616de319c00f00f644f18e2ea34ec2a776d3574fdd08c6225e7045226b3a87198b3ed09c18f8bd36c6e5a

                                                                              • C:\Users\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                96781e7ae2b19dabb5b56f19eaa895c1

                                                                                SHA1

                                                                                8ff2ffd12d2cbfc02380ec99a8d6559c2d0aa386

                                                                                SHA256

                                                                                b98a423261e1fa1782240479fd1bc13dfb139d2b075ecca4f9945f5ac2980e70

                                                                                SHA512

                                                                                afbd7318399dcac91ee0a933ece2724951386ad98b816281140260b26b8dd9d3e74b572e9b32e8da80ae8959e8a19f3de837d8b8be1f8b9630f64cf5279e9189

                                                                              • C:\Users\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                96781e7ae2b19dabb5b56f19eaa895c1

                                                                                SHA1

                                                                                8ff2ffd12d2cbfc02380ec99a8d6559c2d0aa386

                                                                                SHA256

                                                                                b98a423261e1fa1782240479fd1bc13dfb139d2b075ecca4f9945f5ac2980e70

                                                                                SHA512

                                                                                afbd7318399dcac91ee0a933ece2724951386ad98b816281140260b26b8dd9d3e74b572e9b32e8da80ae8959e8a19f3de837d8b8be1f8b9630f64cf5279e9189

                                                                              • C:\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                75368bf8b8b39a7afb0d81255bba4c19

                                                                                SHA1

                                                                                816a76a544abc9ca29a93c4a48691133bcc0d65f

                                                                                SHA256

                                                                                f32bbb43f4faad8cc9a43a3691ddd943b42c25e680b3508a7f5a001c309084fe

                                                                                SHA512

                                                                                5ccab755d147f4710705a996b243cbe9de81d223fe4975619540c059d0c558f5e5c8cad406a010599eab8b142585fa543a83111165123e324897e642ce9a69d3

                                                                              • C:\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                75368bf8b8b39a7afb0d81255bba4c19

                                                                                SHA1

                                                                                816a76a544abc9ca29a93c4a48691133bcc0d65f

                                                                                SHA256

                                                                                f32bbb43f4faad8cc9a43a3691ddd943b42c25e680b3508a7f5a001c309084fe

                                                                                SHA512

                                                                                5ccab755d147f4710705a996b243cbe9de81d223fe4975619540c059d0c558f5e5c8cad406a010599eab8b142585fa543a83111165123e324897e642ce9a69d3

                                                                              • C:\odt\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                c189ccbd502e74c6939d6e42151f1c7a

                                                                                SHA1

                                                                                02110fad288f9ef0adb2515ec48a701e42e01885

                                                                                SHA256

                                                                                df2283af80a5effc7e4bcc72b5dea87af829928376094a93e8556ad609ce74a4

                                                                                SHA512

                                                                                2a8296dfbd86b0e36e15c5308dd17072d315ff041d3dc9b074927a66affcf605bb21df6a68e183e46aa93536e0dda3abef95e250b7c5a9a3249ab5359668213a

                                                                              • C:\odt\backup.exe

                                                                                Filesize

                                                                                72KB

                                                                                MD5

                                                                                c189ccbd502e74c6939d6e42151f1c7a

                                                                                SHA1

                                                                                02110fad288f9ef0adb2515ec48a701e42e01885

                                                                                SHA256

                                                                                df2283af80a5effc7e4bcc72b5dea87af829928376094a93e8556ad609ce74a4

                                                                                SHA512

                                                                                2a8296dfbd86b0e36e15c5308dd17072d315ff041d3dc9b074927a66affcf605bb21df6a68e183e46aa93536e0dda3abef95e250b7c5a9a3249ab5359668213a