Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    221s
  • max time network
    260s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 19:14

General

  • Target

    6fb5689f4bc32cfaf5b16d7737d3f1f97c7dbe2b8377821da68c46e78fb38398.exe

  • Size

    72KB

  • MD5

    0026ba8a6e84a9390489cd95d56b90ec

  • SHA1

    957a6638481b7c8d0abb01ab68c910e142aa0763

  • SHA256

    6fb5689f4bc32cfaf5b16d7737d3f1f97c7dbe2b8377821da68c46e78fb38398

  • SHA512

    22d7a60dd902be85bcd336d70cc394b1f4e306492f8ecd7e12d4f038a05ddaf760bbdf5e483a08ca8d6f0d8ae86615cfc94743fd2473c8b644323445a3c46d23

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2Q:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPE

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fb5689f4bc32cfaf5b16d7737d3f1f97c7dbe2b8377821da68c46e78fb38398.exe
    "C:\Users\Admin\AppData\Local\Temp\6fb5689f4bc32cfaf5b16d7737d3f1f97c7dbe2b8377821da68c46e78fb38398.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4984
    • C:\Users\Admin\AppData\Local\Temp\1766455166\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1766455166\backup.exe C:\Users\Admin\AppData\Local\Temp\1766455166\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1632
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:2912
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:5036
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:4404
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:4976
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:4572
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4704
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:460
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:4616
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:4216
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:3228
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:4892
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:388
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2976
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2248
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:912
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:4944
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:4692
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:3788
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                    PID:5068
                  • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                    8⤵
                    • System policy modification
                    PID:3148
                • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                  7⤵
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:3644
                  • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                    8⤵
                      PID:2568
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:1028
                    • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                      8⤵
                        PID:1176
                      • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                        8⤵
                          PID:4944
                      • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • System policy modification
                        PID:4244
                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                          8⤵
                            PID:4280
                        • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                          7⤵
                            PID:2336
                        • C:\Program Files\Common Files\Services\backup.exe
                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:3036
                        • C:\Program Files\Common Files\System\backup.exe
                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                          6⤵
                          • Disables RegEdit via registry modification
                          • Drops file in Program Files directory
                          • System policy modification
                          PID:4336
                          • C:\Program Files\Common Files\System\ado\backup.exe
                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                            7⤵
                            • Disables RegEdit via registry modification
                            • Drops file in Program Files directory
                            • System policy modification
                            PID:4132
                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                              8⤵
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:1280
                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • System policy modification
                              PID:5072
                            • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                              "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                              8⤵
                                PID:4548
                            • C:\Program Files\Common Files\System\de-DE\backup.exe
                              "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                              7⤵
                              • System policy modification
                              PID:1140
                            • C:\Program Files\Common Files\System\en-US\backup.exe
                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                              7⤵
                                PID:4568
                          • C:\Program Files\Google\backup.exe
                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                            5⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            • System policy modification
                            PID:4260
                            • C:\Program Files\Google\Chrome\backup.exe
                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                              6⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              • System policy modification
                              PID:4088
                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4376
                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                  8⤵
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1292
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                    9⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1224
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                    9⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:2856
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                    9⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1792
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                    9⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:3344
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                    9⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:4704
                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                    9⤵
                                      PID:3500
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                      9⤵
                                      • Disables RegEdit via registry modification
                                      • System policy modification
                                      PID:2516
                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                      9⤵
                                      • System policy modification
                                      PID:3728
                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                        10⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:4264
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                          11⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:2668
                                  • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                    "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1784
                            • C:\Program Files\Internet Explorer\backup.exe
                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                              5⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1308
                              • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                6⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2740
                              • C:\Program Files\Internet Explorer\en-US\backup.exe
                                "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:4512
                              • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                6⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:4384
                              • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1812
                              • C:\Program Files\Internet Explorer\images\backup.exe
                                "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3920
                              • C:\Program Files\Internet Explorer\it-IT\data.exe
                                "C:\Program Files\Internet Explorer\it-IT\data.exe" C:\Program Files\Internet Explorer\it-IT\
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:2732
                              • C:\Program Files\Internet Explorer\ja-JP\System Restore.exe
                                "C:\Program Files\Internet Explorer\ja-JP\System Restore.exe" C:\Program Files\Internet Explorer\ja-JP\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:3548
                              • C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe
                                "C:\Program Files\Internet Explorer\SIGNUP\System Restore.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:3452
                            • C:\Program Files\Java\backup.exe
                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                              5⤵
                              • Modifies visibility of file extensions in Explorer
                              • Drops file in Program Files directory
                              • System policy modification
                              PID:5084
                              • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Drops file in Program Files directory
                                PID:312
                                • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                  "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  PID:3512
                                • C:\Program Files\Java\jdk1.8.0_66\db\backup.exe
                                  "C:\Program Files\Java\jdk1.8.0_66\db\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Drops file in Program Files directory
                                  PID:3380
                                  • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                    "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                    8⤵
                                      PID:3724
                                  • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                    "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                    7⤵
                                      PID:1896
                                  • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                    "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Drops file in Program Files directory
                                    • System policy modification
                                    PID:4236
                                    • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                      "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System policy modification
                                      PID:1044
                                • C:\Program Files\Microsoft Office\backup.exe
                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                  5⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  • System policy modification
                                  PID:4824
                                  • C:\Program Files\Microsoft Office\Office16\backup.exe
                                    "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                    6⤵
                                    • Disables RegEdit via registry modification
                                    PID:4632
                                  • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                    "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                    6⤵
                                      PID:1656
                                  • C:\Program Files\Microsoft Office 15\data.exe
                                    "C:\Program Files\Microsoft Office 15\data.exe" C:\Program Files\Microsoft Office 15\
                                    5⤵
                                      PID:3188
                                  • C:\Program Files (x86)\backup.exe
                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                    4⤵
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • Suspicious use of WriteProcessMemory
                                    • System policy modification
                                    PID:3132
                                    • C:\Program Files (x86)\Adobe\backup.exe
                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                      5⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:536
                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                        6⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:4316
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                          7⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:2268
                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                          7⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:4556
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3492
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\data.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:876
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                            8⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:2428
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              PID:4092
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:520
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:3136
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\data.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Drops file in Program Files directory
                                            PID:4756
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • System policy modification
                                              PID:4208
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\data.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                            8⤵
                                            • Drops file in Program Files directory
                                            PID:4292
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                              9⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:4140
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                            8⤵
                                              PID:1672
                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                            7⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:3392
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Drops file in Program Files directory
                                              PID:4460
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                9⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:1492
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                              8⤵
                                              • Disables RegEdit via registry modification
                                              PID:3048
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                              8⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Drops file in Program Files directory
                                              PID:1932
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                9⤵
                                                  PID:420
                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Drops file in Program Files directory
                                              PID:1320
                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                8⤵
                                                  PID:4692
                                          • C:\Program Files (x86)\Common Files\backup.exe
                                            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                            5⤵
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3688
                                            • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                              "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                              6⤵
                                              • Disables RegEdit via registry modification
                                              • Drops file in Program Files directory
                                              PID:3228
                                              • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                7⤵
                                                  PID:4268
                                                • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                  "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:2748
                                                  • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:2480
                                                • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                  "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                  7⤵
                                                    PID:3784
                                                • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                  "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                  6⤵
                                                  • Drops file in Program Files directory
                                                  • System policy modification
                                                  PID:4936
                                                  • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                    "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                    7⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:3576
                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                  6⤵
                                                    PID:3932
                                                • C:\Program Files (x86)\Google\backup.exe
                                                  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                  5⤵
                                                  • Drops file in Program Files directory
                                                  PID:3144
                                                  • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:2112
                                                • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                  5⤵
                                                    PID:2192
                                                • C:\Users\backup.exe
                                                  C:\Users\backup.exe C:\Users\
                                                  4⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4600
                                                  • C:\Users\Admin\backup.exe
                                                    C:\Users\Admin\backup.exe C:\Users\Admin\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:4896
                                                    • C:\Users\Admin\3D Objects\backup.exe
                                                      "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:2656
                                                    • C:\Users\Admin\Contacts\backup.exe
                                                      C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3084
                                                    • C:\Users\Admin\Desktop\backup.exe
                                                      C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:4960
                                                    • C:\Users\Admin\Documents\backup.exe
                                                      C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1992
                                                    • C:\Users\Admin\Downloads\backup.exe
                                                      C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3456
                                                    • C:\Users\Admin\Favorites\backup.exe
                                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:3384
                                                    • C:\Users\Admin\Links\backup.exe
                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:4500
                                                    • C:\Users\Admin\Music\backup.exe
                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                      6⤵
                                                        PID:972
                                                      • C:\Users\Admin\OneDrive\update.exe
                                                        C:\Users\Admin\OneDrive\update.exe C:\Users\Admin\OneDrive\
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        PID:1880
                                                      • C:\Users\Admin\Pictures\backup.exe
                                                        C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                        6⤵
                                                          PID:4940
                                                          • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                            "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                            7⤵
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:2512
                                                        • C:\Users\Admin\Saved Games\backup.exe
                                                          "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                          6⤵
                                                            PID:1608
                                                        • C:\Users\Public\backup.exe
                                                          C:\Users\Public\backup.exe C:\Users\Public\
                                                          5⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3448
                                                          • C:\Users\Public\Documents\backup.exe
                                                            C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            PID:2656
                                                          • C:\Users\Public\Downloads\update.exe
                                                            C:\Users\Public\Downloads\update.exe C:\Users\Public\Downloads\
                                                            6⤵
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:5112
                                                          • C:\Users\Public\Music\backup.exe
                                                            C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                            6⤵
                                                              PID:3548
                                                        • C:\Windows\backup.exe
                                                          C:\Windows\backup.exe C:\Windows\
                                                          4⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Drops file in Windows directory
                                                          PID:1496
                                                          • C:\Windows\addins\backup.exe
                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                            5⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            PID:1952
                                                          • C:\Windows\appcompat\backup.exe
                                                            C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                            5⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Drops file in Windows directory
                                                            PID:1476
                                                            • C:\Windows\appcompat\appraiser\backup.exe
                                                              C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                              6⤵
                                                              • Drops file in Windows directory
                                                              PID:4392
                                                              • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                7⤵
                                                                • System policy modification
                                                                PID:4032
                                                            • C:\Windows\appcompat\encapsulation\backup.exe
                                                              C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:4924
                                                            • C:\Windows\appcompat\Programs\backup.exe
                                                              C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                              6⤵
                                                                PID:4784
                                                            • C:\Windows\apppatch\backup.exe
                                                              C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                              5⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Drops file in Windows directory
                                                              PID:2572
                                                              • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System policy modification
                                                                PID:2396
                                                            • C:\Windows\AppReadiness\backup.exe
                                                              C:\Windows\AppReadiness\backup.exe C:\Windows\AppReadiness\
                                                              5⤵
                                                                PID:2632
                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                          C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3500
                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                          C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:3508
                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                          C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1944
                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                          2⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:3824
                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                          2⤵
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:1520
                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                          C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:4232

                                                      Network

                                                      MITRE ATT&CK Enterprise v6

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      • C:\PerfLogs\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        11d30f9eb332de47f2455792b7382dac

                                                        SHA1

                                                        bf13cfc7323b13ab058c9c22142c155bdc4563ab

                                                        SHA256

                                                        b6ddaed4f2b20aea3d85204da205feece9d7eb6e8557fdbeae7c3730cda052ed

                                                        SHA512

                                                        ddc087b48750dfcb950521fe0140e3bde39923925172cad66ca2ae3d888267f38e41c7cc99b949c8eb48ac5ec66e81d6a55248de817ada45f4b50df1262cc1c1

                                                      • C:\PerfLogs\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        11d30f9eb332de47f2455792b7382dac

                                                        SHA1

                                                        bf13cfc7323b13ab058c9c22142c155bdc4563ab

                                                        SHA256

                                                        b6ddaed4f2b20aea3d85204da205feece9d7eb6e8557fdbeae7c3730cda052ed

                                                        SHA512

                                                        ddc087b48750dfcb950521fe0140e3bde39923925172cad66ca2ae3d888267f38e41c7cc99b949c8eb48ac5ec66e81d6a55248de817ada45f4b50df1262cc1c1

                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        1a54497bc3bbff4f8edc89e79b0cbb98

                                                        SHA1

                                                        393d855a7456552e3db1ab92b75b48dd4d84f52b

                                                        SHA256

                                                        c645dfad341e3384ff7ef5cc5e3815cd8435d42c904e2f96e29229c5ee6665e9

                                                        SHA512

                                                        ae8bf463ea0df41b0eba7b7ea478d051424d111383a1cb675094bc1096aec4d3ffe2d36011904db82ab12beba7aa9f6011f21610d395c313fcca0e4677e6125e

                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        1a54497bc3bbff4f8edc89e79b0cbb98

                                                        SHA1

                                                        393d855a7456552e3db1ab92b75b48dd4d84f52b

                                                        SHA256

                                                        c645dfad341e3384ff7ef5cc5e3815cd8435d42c904e2f96e29229c5ee6665e9

                                                        SHA512

                                                        ae8bf463ea0df41b0eba7b7ea478d051424d111383a1cb675094bc1096aec4d3ffe2d36011904db82ab12beba7aa9f6011f21610d395c313fcca0e4677e6125e

                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        7fdadb5e7f4fc476fb24f85237764762

                                                        SHA1

                                                        bea071efc6a517f76e4430466a000be76fef4571

                                                        SHA256

                                                        e8ada04218e60eb131db974c7d399683b37d6cb0d85b08ae2c172127ca071bbc

                                                        SHA512

                                                        2ba41860e98acfc673d175440818952d139d62b27c557d451a26fb8f4c619c2c5cd22ae3d2602fb3ebc95850ecd39f0b4fb198b22be2030423edbf42385a39b8

                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        7fdadb5e7f4fc476fb24f85237764762

                                                        SHA1

                                                        bea071efc6a517f76e4430466a000be76fef4571

                                                        SHA256

                                                        e8ada04218e60eb131db974c7d399683b37d6cb0d85b08ae2c172127ca071bbc

                                                        SHA512

                                                        2ba41860e98acfc673d175440818952d139d62b27c557d451a26fb8f4c619c2c5cd22ae3d2602fb3ebc95850ecd39f0b4fb198b22be2030423edbf42385a39b8

                                                      • C:\Program Files (x86)\Adobe\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        8f238957bef3d84ddb814f6e01101562

                                                        SHA1

                                                        48f7eceacff24b07fcc925337c212d6a9327e766

                                                        SHA256

                                                        85d022cba0ded5429d03dff0ed6cf058539fab05298678c2b7e30456b83668d2

                                                        SHA512

                                                        fe400d12031e0d070842289841eb016d84231062ab892a175632970cd9e9dc142c69115b8c523ee066f037e363b0b5e22dd65061ec670525a00dc84cf1e198ec

                                                      • C:\Program Files (x86)\Adobe\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        8f238957bef3d84ddb814f6e01101562

                                                        SHA1

                                                        48f7eceacff24b07fcc925337c212d6a9327e766

                                                        SHA256

                                                        85d022cba0ded5429d03dff0ed6cf058539fab05298678c2b7e30456b83668d2

                                                        SHA512

                                                        fe400d12031e0d070842289841eb016d84231062ab892a175632970cd9e9dc142c69115b8c523ee066f037e363b0b5e22dd65061ec670525a00dc84cf1e198ec

                                                      • C:\Program Files (x86)\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        d6b45811a486e0202625aad9f0cc814a

                                                        SHA1

                                                        edbfca91c7cdf761c84298158423b94b3ce6a123

                                                        SHA256

                                                        921e241e216adc1d614b690d463ab126b8910fe2c6a781862d8533dd0cd24b84

                                                        SHA512

                                                        8046fac8d96ced4ea46cb92e0ad99424f7981741a8b24244681b4282ae81868073f8c2f20664ee417f4d0798fc0d93867cd349c2e93c7b08523aa219af202777

                                                      • C:\Program Files (x86)\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        d6b45811a486e0202625aad9f0cc814a

                                                        SHA1

                                                        edbfca91c7cdf761c84298158423b94b3ce6a123

                                                        SHA256

                                                        921e241e216adc1d614b690d463ab126b8910fe2c6a781862d8533dd0cd24b84

                                                        SHA512

                                                        8046fac8d96ced4ea46cb92e0ad99424f7981741a8b24244681b4282ae81868073f8c2f20664ee417f4d0798fc0d93867cd349c2e93c7b08523aa219af202777

                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        fc12c7b332eba43848d1cc9baeb9bcea

                                                        SHA1

                                                        b21f07640ffb6ed6dde1258c7de0b59a10bff962

                                                        SHA256

                                                        19b1e8c8c82c5e8f9b758403b5a0648998797031602d849c94e80f0e5a76e248

                                                        SHA512

                                                        77eb7077117c9528a2569ed554190732416899f33c4b1072556d0f857132768ad1272705085aae54168720ddd0b61667f09d194c007ea2f5ca9aaf03142490a2

                                                      • C:\Program Files\7-Zip\Lang\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        fc12c7b332eba43848d1cc9baeb9bcea

                                                        SHA1

                                                        b21f07640ffb6ed6dde1258c7de0b59a10bff962

                                                        SHA256

                                                        19b1e8c8c82c5e8f9b758403b5a0648998797031602d849c94e80f0e5a76e248

                                                        SHA512

                                                        77eb7077117c9528a2569ed554190732416899f33c4b1072556d0f857132768ad1272705085aae54168720ddd0b61667f09d194c007ea2f5ca9aaf03142490a2

                                                      • C:\Program Files\7-Zip\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        bd6298736db775440ec0bd30bc94d2d3

                                                        SHA1

                                                        5a421fc730997d07f0ea18fd2552a3ca35e80a01

                                                        SHA256

                                                        418a2186423b496e71656ec496e927de07518ba574f11291355312a1589cc60a

                                                        SHA512

                                                        b6c5fc2b18554deb56cb2c33bda1b46064d820e77b431b3d3b19e5810778e6ca4e3b19cb7dee9b1206930889872f7312f9492b93d53a96e0904a6c9d44717bbb

                                                      • C:\Program Files\7-Zip\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        bd6298736db775440ec0bd30bc94d2d3

                                                        SHA1

                                                        5a421fc730997d07f0ea18fd2552a3ca35e80a01

                                                        SHA256

                                                        418a2186423b496e71656ec496e927de07518ba574f11291355312a1589cc60a

                                                        SHA512

                                                        b6c5fc2b18554deb56cb2c33bda1b46064d820e77b431b3d3b19e5810778e6ca4e3b19cb7dee9b1206930889872f7312f9492b93d53a96e0904a6c9d44717bbb

                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        23ba00551843c34d17172c7836a95c32

                                                        SHA1

                                                        e740aad421e749f7307ea8264e02b97f2d10ada6

                                                        SHA256

                                                        58c98e2511c057cced2a788e58986f408767143cc703049e26be088e40e841aa

                                                        SHA512

                                                        4da94879689c6c31e6654db106102ab65d47d6d3369b800ae586ce5c4594f8ab38889080639f6be9fdd24b648b89aff764333f29b3688e1d1afd8cfbbe177ca0

                                                      • C:\Program Files\Common Files\DESIGNER\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        23ba00551843c34d17172c7836a95c32

                                                        SHA1

                                                        e740aad421e749f7307ea8264e02b97f2d10ada6

                                                        SHA256

                                                        58c98e2511c057cced2a788e58986f408767143cc703049e26be088e40e841aa

                                                        SHA512

                                                        4da94879689c6c31e6654db106102ab65d47d6d3369b800ae586ce5c4594f8ab38889080639f6be9fdd24b648b89aff764333f29b3688e1d1afd8cfbbe177ca0

                                                      • C:\Program Files\Common Files\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        bd6298736db775440ec0bd30bc94d2d3

                                                        SHA1

                                                        5a421fc730997d07f0ea18fd2552a3ca35e80a01

                                                        SHA256

                                                        418a2186423b496e71656ec496e927de07518ba574f11291355312a1589cc60a

                                                        SHA512

                                                        b6c5fc2b18554deb56cb2c33bda1b46064d820e77b431b3d3b19e5810778e6ca4e3b19cb7dee9b1206930889872f7312f9492b93d53a96e0904a6c9d44717bbb

                                                      • C:\Program Files\Common Files\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        bd6298736db775440ec0bd30bc94d2d3

                                                        SHA1

                                                        5a421fc730997d07f0ea18fd2552a3ca35e80a01

                                                        SHA256

                                                        418a2186423b496e71656ec496e927de07518ba574f11291355312a1589cc60a

                                                        SHA512

                                                        b6c5fc2b18554deb56cb2c33bda1b46064d820e77b431b3d3b19e5810778e6ca4e3b19cb7dee9b1206930889872f7312f9492b93d53a96e0904a6c9d44717bbb

                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        75d81a0f5959267a4bffd99f6a5e855d

                                                        SHA1

                                                        379d648e1c28d6463e0cc17a4df28c10059b6752

                                                        SHA256

                                                        b67e432c6764d7a161eaed097eb6e255362205a45a2f3ff120aa943b1974a99a

                                                        SHA512

                                                        805628ffaacc487aef4e6a39f44cc4ded25edac85b5bb730e21c8a3b791c956f016d4b008fc9b354cab3cdd4a1bdf2f8135cc8ce91b1545a8ffc0306c8a9f171

                                                      • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        75d81a0f5959267a4bffd99f6a5e855d

                                                        SHA1

                                                        379d648e1c28d6463e0cc17a4df28c10059b6752

                                                        SHA256

                                                        b67e432c6764d7a161eaed097eb6e255362205a45a2f3ff120aa943b1974a99a

                                                        SHA512

                                                        805628ffaacc487aef4e6a39f44cc4ded25edac85b5bb730e21c8a3b791c956f016d4b008fc9b354cab3cdd4a1bdf2f8135cc8ce91b1545a8ffc0306c8a9f171

                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        41f1cfe7047c7f46a0cbfafa3e10d8ec

                                                        SHA1

                                                        dec4f4901c55e373f26443f714dea78002f53968

                                                        SHA256

                                                        b92c6b0cd42b76fcd57d8ceda4e0f45c6416192ae76125daae9029dcd55acf3f

                                                        SHA512

                                                        7e1fe3951f0fc6887fa3c0d18b997b678835bee5e085404e76ab51237c52a37239ea361f0a3333dcff13be4f4891fde4ac7b8807da24396c6ddc99a1c87c3df0

                                                      • C:\Program Files\Common Files\microsoft shared\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        41f1cfe7047c7f46a0cbfafa3e10d8ec

                                                        SHA1

                                                        dec4f4901c55e373f26443f714dea78002f53968

                                                        SHA256

                                                        b92c6b0cd42b76fcd57d8ceda4e0f45c6416192ae76125daae9029dcd55acf3f

                                                        SHA512

                                                        7e1fe3951f0fc6887fa3c0d18b997b678835bee5e085404e76ab51237c52a37239ea361f0a3333dcff13be4f4891fde4ac7b8807da24396c6ddc99a1c87c3df0

                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        dbc48956c8c3ee1f033080be70e7b34c

                                                        SHA1

                                                        f816c373f042e2de8e9bb53c4ec4892506fbc186

                                                        SHA256

                                                        dcf0b2cf6c0aacbcb7a5d0f48ae0415955eb9c49e56fdc46ddf7c091f51c13db

                                                        SHA512

                                                        30c63417aa0dc7dfe879175816557786bd62d4e1d1e183c50f49706e7c2250becafcd2b367464650dca066049e870cb158f885e0827a1e89311113615ac8f2d7

                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        dbc48956c8c3ee1f033080be70e7b34c

                                                        SHA1

                                                        f816c373f042e2de8e9bb53c4ec4892506fbc186

                                                        SHA256

                                                        dcf0b2cf6c0aacbcb7a5d0f48ae0415955eb9c49e56fdc46ddf7c091f51c13db

                                                        SHA512

                                                        30c63417aa0dc7dfe879175816557786bd62d4e1d1e183c50f49706e7c2250becafcd2b367464650dca066049e870cb158f885e0827a1e89311113615ac8f2d7

                                                      • C:\Program Files\Google\Chrome\Application\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        a9bbce80866c36327ff168631efc8aba

                                                        SHA1

                                                        d4fd7e3d82c5ba8548e85deb96dbdf0645acfc98

                                                        SHA256

                                                        11c6e0aaa4f78df578aa3d58f6c148cb7ac4442fedd9929f219b96023f621a38

                                                        SHA512

                                                        2c080953ea9989a208973807baf341ecae713210bf47f6894e6b744974dcb70c4d8967af22901b52d79232c2a95a0c1a4851f39d294d375ed5ef1565855e2822

                                                      • C:\Program Files\Google\Chrome\Application\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        a9bbce80866c36327ff168631efc8aba

                                                        SHA1

                                                        d4fd7e3d82c5ba8548e85deb96dbdf0645acfc98

                                                        SHA256

                                                        11c6e0aaa4f78df578aa3d58f6c148cb7ac4442fedd9929f219b96023f621a38

                                                        SHA512

                                                        2c080953ea9989a208973807baf341ecae713210bf47f6894e6b744974dcb70c4d8967af22901b52d79232c2a95a0c1a4851f39d294d375ed5ef1565855e2822

                                                      • C:\Program Files\Google\Chrome\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        1179716aa292bf7613340786ff480fcb

                                                        SHA1

                                                        9020c9c43591001acb74d1bcf3673f2970bcc09f

                                                        SHA256

                                                        947fc7e2685d593eb3919ef9ac8414b9256f3313ce222b9acb7b2aecda2100c4

                                                        SHA512

                                                        f8b851d9ebf825a1a1847cf2c4055efeb980c11d4a004da58cdc53201224ba7b10125871aeefbc675dab3f06cb1befc0ba46bd7a4facedf19068eac6bbaac0ee

                                                      • C:\Program Files\Google\Chrome\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        1179716aa292bf7613340786ff480fcb

                                                        SHA1

                                                        9020c9c43591001acb74d1bcf3673f2970bcc09f

                                                        SHA256

                                                        947fc7e2685d593eb3919ef9ac8414b9256f3313ce222b9acb7b2aecda2100c4

                                                        SHA512

                                                        f8b851d9ebf825a1a1847cf2c4055efeb980c11d4a004da58cdc53201224ba7b10125871aeefbc675dab3f06cb1befc0ba46bd7a4facedf19068eac6bbaac0ee

                                                      • C:\Program Files\Google\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        65002ab249b69dda9c61a6a2395c3993

                                                        SHA1

                                                        9f80cfa15853ae9967d7260c15eea23f425fb1d2

                                                        SHA256

                                                        112dc6bded0dc5a2d92475b763a1068ba77066bc79fd6d81476052d7b1db38a7

                                                        SHA512

                                                        045e0bc32d8cb23a737aa1eb3bab70e08a551c078201352293d6106db351761cbbc1fafd0a527276a17c7919d2980e195314389346b481a6112b9301b22d5932

                                                      • C:\Program Files\Google\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        65002ab249b69dda9c61a6a2395c3993

                                                        SHA1

                                                        9f80cfa15853ae9967d7260c15eea23f425fb1d2

                                                        SHA256

                                                        112dc6bded0dc5a2d92475b763a1068ba77066bc79fd6d81476052d7b1db38a7

                                                        SHA512

                                                        045e0bc32d8cb23a737aa1eb3bab70e08a551c078201352293d6106db351761cbbc1fafd0a527276a17c7919d2980e195314389346b481a6112b9301b22d5932

                                                      • C:\Program Files\Internet Explorer\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        944b2e226d4d93f24a217be119d052c7

                                                        SHA1

                                                        ea8f6aa73929402254cdd89e42d59c346211fa01

                                                        SHA256

                                                        127bc7cd591d823ebe7c875d4c8ba9fb322d8ffaf7de67d73e71c8b8448e690d

                                                        SHA512

                                                        ef913f171cf810cb03d9f4c8332798b8d8ecc9a32f6a3a74aecac71474de034d95c3db8bbe9acbf82ac028de9e0304d436abfcea15e0d13d37e9b080054bc386

                                                      • C:\Program Files\Internet Explorer\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        944b2e226d4d93f24a217be119d052c7

                                                        SHA1

                                                        ea8f6aa73929402254cdd89e42d59c346211fa01

                                                        SHA256

                                                        127bc7cd591d823ebe7c875d4c8ba9fb322d8ffaf7de67d73e71c8b8448e690d

                                                        SHA512

                                                        ef913f171cf810cb03d9f4c8332798b8d8ecc9a32f6a3a74aecac71474de034d95c3db8bbe9acbf82ac028de9e0304d436abfcea15e0d13d37e9b080054bc386

                                                      • C:\Program Files\Internet Explorer\de-DE\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        9fae2b3080a7151ef5eb254dab9a4be4

                                                        SHA1

                                                        7ebe665a9e5716a55298cc914ad75592dc803023

                                                        SHA256

                                                        cc2c4c27ae778953ca1909cccd88cb58927c1f4aaca4a25546164f06554f995f

                                                        SHA512

                                                        00f769cb8cf140aeb3d8e0f85e069b768049a07201062c7e3aad8dc51d9ba7bd359d21172d8a583326fe453c50c1f9284448eaaea7b517fb832c209f204a2641

                                                      • C:\Program Files\Internet Explorer\de-DE\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        9fae2b3080a7151ef5eb254dab9a4be4

                                                        SHA1

                                                        7ebe665a9e5716a55298cc914ad75592dc803023

                                                        SHA256

                                                        cc2c4c27ae778953ca1909cccd88cb58927c1f4aaca4a25546164f06554f995f

                                                        SHA512

                                                        00f769cb8cf140aeb3d8e0f85e069b768049a07201062c7e3aad8dc51d9ba7bd359d21172d8a583326fe453c50c1f9284448eaaea7b517fb832c209f204a2641

                                                      • C:\Program Files\Internet Explorer\en-US\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        9fae2b3080a7151ef5eb254dab9a4be4

                                                        SHA1

                                                        7ebe665a9e5716a55298cc914ad75592dc803023

                                                        SHA256

                                                        cc2c4c27ae778953ca1909cccd88cb58927c1f4aaca4a25546164f06554f995f

                                                        SHA512

                                                        00f769cb8cf140aeb3d8e0f85e069b768049a07201062c7e3aad8dc51d9ba7bd359d21172d8a583326fe453c50c1f9284448eaaea7b517fb832c209f204a2641

                                                      • C:\Program Files\Internet Explorer\en-US\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        9fae2b3080a7151ef5eb254dab9a4be4

                                                        SHA1

                                                        7ebe665a9e5716a55298cc914ad75592dc803023

                                                        SHA256

                                                        cc2c4c27ae778953ca1909cccd88cb58927c1f4aaca4a25546164f06554f995f

                                                        SHA512

                                                        00f769cb8cf140aeb3d8e0f85e069b768049a07201062c7e3aad8dc51d9ba7bd359d21172d8a583326fe453c50c1f9284448eaaea7b517fb832c209f204a2641

                                                      • C:\Program Files\Internet Explorer\es-ES\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        d00ffcefdc9209419741424963d9d981

                                                        SHA1

                                                        1925273746f56399a6e207e59640e59b16b644ee

                                                        SHA256

                                                        d64ca1df86aeb544223bbeafa53ebbc833c4ead153d180bd7433316d4df93a06

                                                        SHA512

                                                        c8ee3331644489522a23aa12f3d15ab1ae4eab5b99b5c6253847f84c98679d103f9d2b756ab646bd7bbc3768deddf3c24b257f339068e38dbf037b2be945a49f

                                                      • C:\Program Files\Internet Explorer\es-ES\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        d00ffcefdc9209419741424963d9d981

                                                        SHA1

                                                        1925273746f56399a6e207e59640e59b16b644ee

                                                        SHA256

                                                        d64ca1df86aeb544223bbeafa53ebbc833c4ead153d180bd7433316d4df93a06

                                                        SHA512

                                                        c8ee3331644489522a23aa12f3d15ab1ae4eab5b99b5c6253847f84c98679d103f9d2b756ab646bd7bbc3768deddf3c24b257f339068e38dbf037b2be945a49f

                                                      • C:\Program Files\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        b399ba2cb05a97d21c7b725723c91d3a

                                                        SHA1

                                                        77bcfbd511c9caa646c6efff5c5b4391e84f066a

                                                        SHA256

                                                        f18f62cac7bec3f621440ae45fe6a149864b03c6b1650b3aaaae4f6c1973fbbf

                                                        SHA512

                                                        8a3599d645b7d9d61481c78f5438ae47707aa4d9ccf35e39850fc52fd4e9b4b2d3d475f814243d903bcc3c1bb084ddbb0371bd57b9fbadcf9c26352d69f46097

                                                      • C:\Program Files\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        b399ba2cb05a97d21c7b725723c91d3a

                                                        SHA1

                                                        77bcfbd511c9caa646c6efff5c5b4391e84f066a

                                                        SHA256

                                                        f18f62cac7bec3f621440ae45fe6a149864b03c6b1650b3aaaae4f6c1973fbbf

                                                        SHA512

                                                        8a3599d645b7d9d61481c78f5438ae47707aa4d9ccf35e39850fc52fd4e9b4b2d3d475f814243d903bcc3c1bb084ddbb0371bd57b9fbadcf9c26352d69f46097

                                                      • C:\Users\Admin\3D Objects\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        7c227c47e3a41992d2c2bbc6d959bf37

                                                        SHA1

                                                        af1a5f4088bee654576df77c1cb004286f3ff83c

                                                        SHA256

                                                        eddbedb15938b5c1526d06c89a7e359be195e03b831995b0c76079bd8c7ad6fd

                                                        SHA512

                                                        fd0f0bff5d9350250648b3758923d92a990d12aeba5daa5da55bbfca5c5ddd1f4ef061847210685a77f7413cac238bbac37e2e98162c0a114582b426a3cc298b

                                                      • C:\Users\Admin\3D Objects\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        7c227c47e3a41992d2c2bbc6d959bf37

                                                        SHA1

                                                        af1a5f4088bee654576df77c1cb004286f3ff83c

                                                        SHA256

                                                        eddbedb15938b5c1526d06c89a7e359be195e03b831995b0c76079bd8c7ad6fd

                                                        SHA512

                                                        fd0f0bff5d9350250648b3758923d92a990d12aeba5daa5da55bbfca5c5ddd1f4ef061847210685a77f7413cac238bbac37e2e98162c0a114582b426a3cc298b

                                                      • C:\Users\Admin\AppData\Local\Temp\1766455166\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        ab671fa60d75b4bffe913659dcae9997

                                                        SHA1

                                                        972e610df6d054c01ab041b944a6646c8749717c

                                                        SHA256

                                                        328c2254f7c47193cc970b88b936a48588315171eb9e5d0f22e9a82ff2a1beaf

                                                        SHA512

                                                        7e920cabdd4ce3c0f9cb911a34ac97d1db418edeedd1af4b30c69c8b028ea6fe4040bcb0e48d53563c09dd86e358d7635256ace353b05e9c1d9657aa86807020

                                                      • C:\Users\Admin\AppData\Local\Temp\1766455166\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        ab671fa60d75b4bffe913659dcae9997

                                                        SHA1

                                                        972e610df6d054c01ab041b944a6646c8749717c

                                                        SHA256

                                                        328c2254f7c47193cc970b88b936a48588315171eb9e5d0f22e9a82ff2a1beaf

                                                        SHA512

                                                        7e920cabdd4ce3c0f9cb911a34ac97d1db418edeedd1af4b30c69c8b028ea6fe4040bcb0e48d53563c09dd86e358d7635256ace353b05e9c1d9657aa86807020

                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        13412d96b572122545e9aa3d92298db8

                                                        SHA1

                                                        d091a91f4adc914e79196916ebd94a7fb80bd2c1

                                                        SHA256

                                                        10f1d0d115bd74116e331244144473cf67bd120b4ba0f74429164251ea4d04af

                                                        SHA512

                                                        d132218c0853e8bf37a25404dbf060730300d02264d6331e2ceece5a741bbc9439f613e00c0f7f7a92e38a6039805ed02648e49ea79b41e47d1084421f7bc1db

                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        e68eb813fde8013443d19ba92ebf1166

                                                        SHA1

                                                        3b0d2762e141ed8eee368c2b3fcf8995feef1f5e

                                                        SHA256

                                                        133fd704fce64ca143ac976025e8a7331a391a0ddb9b3c8a0e6b34681e4d8699

                                                        SHA512

                                                        4ac673b82e2c947235edc090abd09f840faea9dfc9d0cef29d480d4696db7af74f9c0aae020d9760e29004419724f227a5850058bb8e06c20c7a99e5db05af0b

                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        e68eb813fde8013443d19ba92ebf1166

                                                        SHA1

                                                        3b0d2762e141ed8eee368c2b3fcf8995feef1f5e

                                                        SHA256

                                                        133fd704fce64ca143ac976025e8a7331a391a0ddb9b3c8a0e6b34681e4d8699

                                                        SHA512

                                                        4ac673b82e2c947235edc090abd09f840faea9dfc9d0cef29d480d4696db7af74f9c0aae020d9760e29004419724f227a5850058bb8e06c20c7a99e5db05af0b

                                                      • C:\Users\Admin\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        1a364b8cf7f19709b0e66f8cebe8ee35

                                                        SHA1

                                                        2968a9f23a5748d67482c5b9dfbc426ab12565f8

                                                        SHA256

                                                        926478b3d649f6f6d8912e549826c6b2d445488249b7e7c7547dfe9dc95eb863

                                                        SHA512

                                                        f548d67b8ae1ada53ce5c978eb07de46cae43589b6552f17e668a615faaffc3e82145d1236ee84470113f0281bd96898675e3cb8a64680e5e9004a63cca839f5

                                                      • C:\Users\Admin\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        1a364b8cf7f19709b0e66f8cebe8ee35

                                                        SHA1

                                                        2968a9f23a5748d67482c5b9dfbc426ab12565f8

                                                        SHA256

                                                        926478b3d649f6f6d8912e549826c6b2d445488249b7e7c7547dfe9dc95eb863

                                                        SHA512

                                                        f548d67b8ae1ada53ce5c978eb07de46cae43589b6552f17e668a615faaffc3e82145d1236ee84470113f0281bd96898675e3cb8a64680e5e9004a63cca839f5

                                                      • C:\Users\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        0379d608d4e1781cccae244ff2726268

                                                        SHA1

                                                        31c5a593a78fe3c7f2e3762113035b3682a3841e

                                                        SHA256

                                                        5e8a4ac37319316063c461b78a50a706e7af588d8eb8a0ba0467b222adf58cf9

                                                        SHA512

                                                        9782402ac23110097b91e8a040111bb7e9302a31f39ddc362d385b8f5b1d831ae5bb4fd74b2f2ac1afc0bf0403609f4f1b19b38dad907915ec9ec344d0ffc035

                                                      • C:\Users\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        0379d608d4e1781cccae244ff2726268

                                                        SHA1

                                                        31c5a593a78fe3c7f2e3762113035b3682a3841e

                                                        SHA256

                                                        5e8a4ac37319316063c461b78a50a706e7af588d8eb8a0ba0467b222adf58cf9

                                                        SHA512

                                                        9782402ac23110097b91e8a040111bb7e9302a31f39ddc362d385b8f5b1d831ae5bb4fd74b2f2ac1afc0bf0403609f4f1b19b38dad907915ec9ec344d0ffc035

                                                      • C:\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        5ba73543c16829fb833a916a94f22076

                                                        SHA1

                                                        ad40ed9cc6cc373cf4a3856d485f484be4565c9e

                                                        SHA256

                                                        29f4d37d3afd94c5db61024dbcde7549bd93d58bf9fbea82f5f665e7156d539f

                                                        SHA512

                                                        35a914630f758563da8009dde469a8821280d14fa1a9d9ef8568c5b0973efa58996e7bfa43da243617f0e1cbd644d4842f995358d7285a543354c7f54fb092b4

                                                      • C:\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        5ba73543c16829fb833a916a94f22076

                                                        SHA1

                                                        ad40ed9cc6cc373cf4a3856d485f484be4565c9e

                                                        SHA256

                                                        29f4d37d3afd94c5db61024dbcde7549bd93d58bf9fbea82f5f665e7156d539f

                                                        SHA512

                                                        35a914630f758563da8009dde469a8821280d14fa1a9d9ef8568c5b0973efa58996e7bfa43da243617f0e1cbd644d4842f995358d7285a543354c7f54fb092b4

                                                      • C:\odt\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        11d30f9eb332de47f2455792b7382dac

                                                        SHA1

                                                        bf13cfc7323b13ab058c9c22142c155bdc4563ab

                                                        SHA256

                                                        b6ddaed4f2b20aea3d85204da205feece9d7eb6e8557fdbeae7c3730cda052ed

                                                        SHA512

                                                        ddc087b48750dfcb950521fe0140e3bde39923925172cad66ca2ae3d888267f38e41c7cc99b949c8eb48ac5ec66e81d6a55248de817ada45f4b50df1262cc1c1

                                                      • C:\odt\backup.exe

                                                        Filesize

                                                        72KB

                                                        MD5

                                                        11d30f9eb332de47f2455792b7382dac

                                                        SHA1

                                                        bf13cfc7323b13ab058c9c22142c155bdc4563ab

                                                        SHA256

                                                        b6ddaed4f2b20aea3d85204da205feece9d7eb6e8557fdbeae7c3730cda052ed

                                                        SHA512

                                                        ddc087b48750dfcb950521fe0140e3bde39923925172cad66ca2ae3d888267f38e41c7cc99b949c8eb48ac5ec66e81d6a55248de817ada45f4b50df1262cc1c1