Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

17421b249d...fc.exe

windows7-x64

10

17421b249d...fc.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    208s
  • max time network
    244s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/12/2022, 19:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17421b249df237f51bc0b5346757d75d900e705b343c9699f52cb3c6ec2dcefc.exe

  • Size

    72KB

  • MD5

    056805a995971dc7d80b0c97f0d7d42b

  • SHA1

    adee519fdc8a9c0370983d10152828f9c92f162e

  • SHA256

    17421b249df237f51bc0b5346757d75d900e705b343c9699f52cb3c6ec2dcefc

  • SHA512

    3f6a3e11706034197f35e00cf0966008ea50c290f539407fa701c758b433bf1a2777107fec7c23418615d85d924e75d9b24ae15aa384fa33107778d6f0a8d063

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf29:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPJ

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 11 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\17421b249df237f51bc0b5346757d75d900e705b343c9699f52cb3c6ec2dcefc.exe
    "C:\Users\Admin\AppData\Local\Temp\17421b249df237f51bc0b5346757d75d900e705b343c9699f52cb3c6ec2dcefc.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Users\Admin\AppData\Local\Temp\3327237043\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3327237043\backup.exe C:\Users\Admin\AppData\Local\Temp\3327237043\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2184
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4100
        • C:\odt\backup.exe
          C:\odt\backup.exe C:\odt\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:1840
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          • System policy modification
          PID:3788
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1976
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3540
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:2376
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3200
            • C:\Program Files\Common Files\DESIGNER\backup.exe
              "C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1044
            • C:\Program Files\Common Files\microsoft shared\backup.exe
              "C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\
              6⤵
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:3032
              • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:5100
              • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                "C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2548
                • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1472
                • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1096
                • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1836
                • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3152
                • C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1364
                • C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\el-GR\data.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2544
                • C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:3208
                • C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\en-US\data.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:5064
                • C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:4004
                • C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:3356
                • C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\
                  8⤵
                    PID:4692
                  • C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:4452
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:4628
                  • C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe
                    "C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\
                    8⤵
                      PID:2684
                    • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe
                      "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\
                      8⤵
                      • Drops file in Program Files directory
                      • System policy modification
                      PID:1720
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\
                        9⤵
                        • System policy modification
                        PID:1508
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\
                        9⤵
                        • Modifies visibility of file extensions in Explorer
                        PID:4748
                      • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe
                        "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\
                        9⤵
                          PID:2468
                        • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe
                          "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\
                          9⤵
                            PID:3400
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\
                            9⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:1072
                          • C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\
                            9⤵
                              PID:4940
                          • C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\he-IL\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • System policy modification
                            PID:4768
                          • C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hr-HR\
                            8⤵
                              PID:1120
                            • C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\hu-HU\
                              8⤵
                              • System policy modification
                              PID:4052
                            • C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:4720
                          • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                            "C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\
                            7⤵
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1960
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\update.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4108
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2624
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:4988
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1656
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:5048
                            • C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\
                              8⤵
                                PID:2868
                            • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3396
                              • C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\
                                8⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:3204
                            • C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:3592
                            • C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\
                              7⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:3000
                            • C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe
                              "C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • System policy modification
                              PID:1612
                            • C:\Program Files\Common Files\microsoft shared\TextConv\data.exe
                              "C:\Program Files\Common Files\microsoft shared\TextConv\data.exe" C:\Program Files\Common Files\microsoft shared\TextConv\
                              7⤵
                              • System policy modification
                              PID:4344
                              • C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\
                                8⤵
                                  PID:4748
                              • C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe
                                "C:\Program Files\Common Files\microsoft shared\Triedit\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\
                                7⤵
                                  PID:2676
                                  • C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\Triedit\en-US\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    PID:2376
                                • C:\Program Files\Common Files\microsoft shared\VC\backup.exe
                                  "C:\Program Files\Common Files\microsoft shared\VC\backup.exe" C:\Program Files\Common Files\microsoft shared\VC\
                                  7⤵
                                    PID:3208
                                  • C:\Program Files\Common Files\microsoft shared\VGX\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VGX\backup.exe" C:\Program Files\Common Files\microsoft shared\VGX\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • System policy modification
                                    PID:5020
                                  • C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe
                                    "C:\Program Files\Common Files\microsoft shared\VSTO\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\
                                    7⤵
                                    • System policy modification
                                    PID:1960
                                    • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe
                                      "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\
                                      8⤵
                                        PID:4388
                                        • C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe
                                          "C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\
                                          9⤵
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:3752
                                  • C:\Program Files\Common Files\Services\backup.exe
                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                    6⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:2868
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    PID:4952
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:1504
                                      • C:\Program Files\Common Files\System\ado\de-DE\data.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\data.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        PID:3668
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:1616
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:1112
                                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                        8⤵
                                        • Disables RegEdit via registry modification
                                        • System policy modification
                                        PID:2248
                                      • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                        8⤵
                                          PID:2000
                                        • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System policy modification
                                          PID:4048
                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                        7⤵
                                          PID:3524
                                        • C:\Program Files\Common Files\System\en-US\data.exe
                                          "C:\Program Files\Common Files\System\en-US\data.exe" C:\Program Files\Common Files\System\en-US\
                                          7⤵
                                          • System policy modification
                                          PID:5044
                                        • C:\Program Files\Common Files\System\es-ES\backup.exe
                                          "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                          7⤵
                                          • Modifies visibility of file extensions in Explorer
                                          PID:760
                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                          7⤵
                                          • System policy modification
                                          PID:4580
                                        • C:\Program Files\Common Files\System\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                          7⤵
                                          • Disables RegEdit via registry modification
                                          PID:2652
                                        • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                          7⤵
                                          • Disables RegEdit via registry modification
                                          PID:1760
                                        • C:\Program Files\Common Files\System\msadc\backup.exe
                                          "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                          7⤵
                                          • Drops file in Program Files directory
                                          PID:3556
                                          • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                            "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                            8⤵
                                              PID:1292
                                            • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                              8⤵
                                                PID:4224
                                              • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                8⤵
                                                  PID:1972
                                                • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  PID:1944
                                          • C:\Program Files\Google\backup.exe
                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                            5⤵
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1284
                                            • C:\Program Files\Google\Chrome\backup.exe
                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:4624
                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:3140
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                  8⤵
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1660
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                    9⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:4072
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                    9⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4220
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                    9⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:4448
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                    9⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:3156
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                    9⤵
                                                    • System policy modification
                                                    PID:3604
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\System Restore.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                    9⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:4000
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                    9⤵
                                                      PID:1236
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                      9⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:3584
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                        10⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        PID:3888
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                          11⤵
                                                            PID:4396
                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                      8⤵
                                                        PID:2100
                                                • C:\Program Files\Internet Explorer\backup.exe
                                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                  5⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:4880
                                                  • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2804
                                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1236
                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:4664
                                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1148
                                                  • C:\Program Files\Internet Explorer\images\backup.exe
                                                    "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                    6⤵
                                                    • System policy modification
                                                    PID:3888
                                                  • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                    "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                    6⤵
                                                      PID:876
                                                    • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                      "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:3608
                                                    • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                      "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      PID:1928
                                                  • C:\Program Files\Java\System Restore.exe
                                                    "C:\Program Files\Java\System Restore.exe" C:\Program Files\Java\
                                                    5⤵
                                                      PID:2476
                                                      • C:\Program Files\Java\jdk1.8.0_66\backup.exe
                                                        "C:\Program Files\Java\jdk1.8.0_66\backup.exe" C:\Program Files\Java\jdk1.8.0_66\
                                                        6⤵
                                                        • Drops file in Program Files directory
                                                        PID:1308
                                                        • C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\bin\
                                                          7⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          PID:4340
                                                        • C:\Program Files\Java\jdk1.8.0_66\db\update.exe
                                                          "C:\Program Files\Java\jdk1.8.0_66\db\update.exe" C:\Program Files\Java\jdk1.8.0_66\db\
                                                          7⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          PID:3152
                                                          • C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\db\bin\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\bin\
                                                            8⤵
                                                            • Disables RegEdit via registry modification
                                                            PID:484
                                                          • C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\db\lib\backup.exe" C:\Program Files\Java\jdk1.8.0_66\db\lib\
                                                            8⤵
                                                              PID:4516
                                                          • C:\Program Files\Java\jdk1.8.0_66\include\backup.exe
                                                            "C:\Program Files\Java\jdk1.8.0_66\include\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            PID:2688
                                                            • C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe
                                                              "C:\Program Files\Java\jdk1.8.0_66\include\win32\backup.exe" C:\Program Files\Java\jdk1.8.0_66\include\win32\
                                                              8⤵
                                                                PID:1812
                                                          • C:\Program Files\Java\jre1.8.0_66\backup.exe
                                                            "C:\Program Files\Java\jre1.8.0_66\backup.exe" C:\Program Files\Java\jre1.8.0_66\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            PID:1524
                                                            • C:\Program Files\Java\jre1.8.0_66\bin\backup.exe
                                                              "C:\Program Files\Java\jre1.8.0_66\bin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\
                                                              7⤵
                                                              • Disables RegEdit via registry modification
                                                              • Drops file in Program Files directory
                                                              PID:1960
                                                              • C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe
                                                                "C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\dtplugin\
                                                                8⤵
                                                                • System policy modification
                                                                PID:2444
                                                              • C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe
                                                                "C:\Program Files\Java\jre1.8.0_66\bin\plugin2\backup.exe" C:\Program Files\Java\jre1.8.0_66\bin\plugin2\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                PID:3952
                                                        • C:\Program Files\Microsoft Office\backup.exe
                                                          "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                          5⤵
                                                          • Drops file in Program Files directory
                                                          • System policy modification
                                                          PID:1824
                                                          • C:\Program Files\Microsoft Office\Office16\backup.exe
                                                            "C:\Program Files\Microsoft Office\Office16\backup.exe" C:\Program Files\Microsoft Office\Office16\
                                                            6⤵
                                                            • System policy modification
                                                            PID:396
                                                          • C:\Program Files\Microsoft Office\PackageManifests\backup.exe
                                                            "C:\Program Files\Microsoft Office\PackageManifests\backup.exe" C:\Program Files\Microsoft Office\PackageManifests\
                                                            6⤵
                                                              PID:5008
                                                            • C:\Program Files\Microsoft Office\root\backup.exe
                                                              "C:\Program Files\Microsoft Office\root\backup.exe" C:\Program Files\Microsoft Office\root\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Drops file in Program Files directory
                                                              PID:4760
                                                              • C:\Program Files\Microsoft Office\root\Client\backup.exe
                                                                "C:\Program Files\Microsoft Office\root\Client\backup.exe" C:\Program Files\Microsoft Office\root\Client\
                                                                7⤵
                                                                  PID:3176
                                                                • C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe
                                                                  "C:\Program Files\Microsoft Office\root\Document Themes 16\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\
                                                                  7⤵
                                                                    PID:3648
                                                                    • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe
                                                                      "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\
                                                                      8⤵
                                                                        PID:1844
                                                                      • C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe
                                                                        "C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\backup.exe" C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\
                                                                        8⤵
                                                                          PID:5112
                                                                  • C:\Program Files\Microsoft Office 15\backup.exe
                                                                    "C:\Program Files\Microsoft Office 15\backup.exe" C:\Program Files\Microsoft Office 15\
                                                                    5⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    • System policy modification
                                                                    PID:2224
                                                                    • C:\Program Files\Microsoft Office 15\ClientX64\backup.exe
                                                                      "C:\Program Files\Microsoft Office 15\ClientX64\backup.exe" C:\Program Files\Microsoft Office 15\ClientX64\
                                                                      6⤵
                                                                      • Disables RegEdit via registry modification
                                                                      PID:3624
                                                                  • C:\Program Files\Mozilla Firefox\backup.exe
                                                                    "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                    5⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Drops file in Program Files directory
                                                                    PID:4580
                                                                    • C:\Program Files\Mozilla Firefox\browser\backup.exe
                                                                      "C:\Program Files\Mozilla Firefox\browser\backup.exe" C:\Program Files\Mozilla Firefox\browser\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:1884
                                                                      • C:\Program Files\Mozilla Firefox\browser\features\backup.exe
                                                                        "C:\Program Files\Mozilla Firefox\browser\features\backup.exe" C:\Program Files\Mozilla Firefox\browser\features\
                                                                        7⤵
                                                                          PID:1520
                                                                        • C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe
                                                                          "C:\Program Files\Mozilla Firefox\browser\VisualElements\backup.exe" C:\Program Files\Mozilla Firefox\browser\VisualElements\
                                                                          7⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:1316
                                                                      • C:\Program Files\Mozilla Firefox\defaults\backup.exe
                                                                        "C:\Program Files\Mozilla Firefox\defaults\backup.exe" C:\Program Files\Mozilla Firefox\defaults\
                                                                        6⤵
                                                                          PID:1808
                                                                    • C:\Program Files (x86)\backup.exe
                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                      4⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:3128
                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                        5⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1444
                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:800
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:3424
                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\
                                                                            7⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:2380
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Drops file in Program Files directory
                                                                              PID:5004
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\
                                                                                9⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:1364
                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\
                                                                              8⤵
                                                                                PID:4708
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\
                                                                                  9⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  PID:2668
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                PID:5100
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                PID:4464
                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\
                                                                                8⤵
                                                                                • Disables RegEdit via registry modification
                                                                                PID:4428
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\
                                                                                  9⤵
                                                                                    PID:4720
                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\
                                                                                  8⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • System policy modification
                                                                                  PID:4708
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\ENU\
                                                                                    9⤵
                                                                                      PID:3544
                                                                                  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\
                                                                                    8⤵
                                                                                      PID:1944
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\
                                                                                      8⤵
                                                                                      • System policy modification
                                                                                      PID:556
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\
                                                                                        9⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • System policy modification
                                                                                        PID:5052
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\
                                                                                      8⤵
                                                                                        PID:4628
                                                                                    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\
                                                                                      7⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Drops file in Program Files directory
                                                                                      PID:4080
                                                                                      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\
                                                                                        8⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Drops file in Program Files directory
                                                                                        • System policy modification
                                                                                        PID:1364
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\PFM\
                                                                                          9⤵
                                                                                            PID:4192
                                                                                        • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\data.exe
                                                                                          "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\data.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\SaslPrep\
                                                                                          8⤵
                                                                                            PID:4056
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\
                                                                                            8⤵
                                                                                              PID:2044
                                                                                              • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\System Restore.exe
                                                                                                "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\System Restore.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\
                                                                                                9⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • System policy modification
                                                                                                PID:2868
                                                                                                • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\
                                                                                                  10⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  PID:648
                                                                                          • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\
                                                                                            7⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            PID:456
                                                                                            • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Setup Files\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              PID:2232
                                                                                      • C:\Program Files (x86)\Common Files\data.exe
                                                                                        "C:\Program Files (x86)\Common Files\data.exe" C:\Program Files (x86)\Common Files\
                                                                                        5⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Drops file in Program Files directory
                                                                                        PID:2268
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                          6⤵
                                                                                          • Drops file in Program Files directory
                                                                                          PID:4076
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                            7⤵
                                                                                            • Drops file in Program Files directory
                                                                                            PID:3904
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\ARM\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\
                                                                                            7⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Drops file in Program Files directory
                                                                                            PID:3972
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:4344
                                                                                          • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\
                                                                                            7⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Drops file in Program Files directory
                                                                                            • System policy modification
                                                                                            PID:4880
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\
                                                                                              8⤵
                                                                                                PID:1760
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\
                                                                                              7⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              PID:4908
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Reader\DC\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Reader\DC\
                                                                                                8⤵
                                                                                                  PID:3108
                                                                                            • C:\Program Files (x86)\Common Files\Java\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Java\backup.exe" C:\Program Files (x86)\Common Files\Java\
                                                                                              6⤵
                                                                                                PID:2296
                                                                                                • C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Java\Java Update\backup.exe" C:\Program Files (x86)\Common Files\Java\Java Update\
                                                                                                  7⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System policy modification
                                                                                                  PID:3996
                                                                                              • C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Microsoft Shared\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\
                                                                                                6⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Drops file in Program Files directory
                                                                                                PID:2032
                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\DAO\
                                                                                                  7⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  PID:4192
                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\Filters\
                                                                                                  7⤵
                                                                                                    PID:5036
                                                                                                  • C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files (x86)\Common Files\Microsoft Shared\ink\
                                                                                                    7⤵
                                                                                                      PID:2248
                                                                                                • C:\Program Files (x86)\Google\backup.exe
                                                                                                  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                  5⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Drops file in Program Files directory
                                                                                                  • System policy modification
                                                                                                  PID:5104
                                                                                                  • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                    6⤵
                                                                                                      PID:4360
                                                                                                    • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                      "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                      6⤵
                                                                                                      • System policy modification
                                                                                                      PID:4028
                                                                                                    • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                      "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                      6⤵
                                                                                                        PID:2444
                                                                                                      • C:\Program Files (x86)\Google\Update\backup.exe
                                                                                                        "C:\Program Files (x86)\Google\Update\backup.exe" C:\Program Files (x86)\Google\Update\
                                                                                                        6⤵
                                                                                                        • Drops file in Program Files directory
                                                                                                        • System policy modification
                                                                                                        PID:4732
                                                                                                        • C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe
                                                                                                          "C:\Program Files (x86)\Google\Update\1.3.36.71\backup.exe" C:\Program Files (x86)\Google\Update\1.3.36.71\
                                                                                                          7⤵
                                                                                                            PID:1080
                                                                                                          • C:\Program Files (x86)\Google\Update\Download\update.exe
                                                                                                            "C:\Program Files (x86)\Google\Update\Download\update.exe" C:\Program Files (x86)\Google\Update\Download\
                                                                                                            7⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:1320
                                                                                                            • C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe
                                                                                                              "C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\backup.exe" C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\
                                                                                                              8⤵
                                                                                                                PID:1900
                                                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                          5⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Drops file in Program Files directory
                                                                                                          • System policy modification
                                                                                                          PID:2560
                                                                                                          • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                            "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                            6⤵
                                                                                                              PID:1304
                                                                                                            • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                              "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                              6⤵
                                                                                                                PID:3952
                                                                                                              • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                6⤵
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                PID:428
                                                                                                              • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                6⤵
                                                                                                                  PID:3500
                                                                                                                • C:\Program Files (x86)\Internet Explorer\images\backup.exe
                                                                                                                  "C:\Program Files (x86)\Internet Explorer\images\backup.exe" C:\Program Files (x86)\Internet Explorer\images\
                                                                                                                  6⤵
                                                                                                                    PID:180
                                                                                                              • C:\Users\backup.exe
                                                                                                                C:\Users\backup.exe C:\Users\
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:2516
                                                                                                                • C:\Users\Admin\backup.exe
                                                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                  5⤵
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:4908
                                                                                                                  • C:\Users\Admin\3D Objects\backup.exe
                                                                                                                    "C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:3776
                                                                                                                  • C:\Users\Admin\Contacts\backup.exe
                                                                                                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:1816
                                                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                    PID:1500
                                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                    6⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1516
                                                                                                                  • C:\Users\Admin\Downloads\backup.exe
                                                                                                                    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                    6⤵
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    PID:828
                                                                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                    6⤵
                                                                                                                      PID:1912
                                                                                                                    • C:\Users\Admin\Links\backup.exe
                                                                                                                      C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                      6⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • System policy modification
                                                                                                                      PID:1904
                                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                      6⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      PID:2356
                                                                                                                    • C:\Users\Admin\OneDrive\backup.exe
                                                                                                                      C:\Users\Admin\OneDrive\backup.exe C:\Users\Admin\OneDrive\
                                                                                                                      6⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      PID:1156
                                                                                                                    • C:\Users\Admin\Pictures\backup.exe
                                                                                                                      C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                      6⤵
                                                                                                                        PID:4768
                                                                                                                        • C:\Users\Admin\Pictures\Camera Roll\backup.exe
                                                                                                                          "C:\Users\Admin\Pictures\Camera Roll\backup.exe" C:\Users\Admin\Pictures\Camera Roll\
                                                                                                                          7⤵
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • System policy modification
                                                                                                                          PID:4040
                                                                                                                        • C:\Users\Admin\Pictures\Saved Pictures\backup.exe
                                                                                                                          "C:\Users\Admin\Pictures\Saved Pictures\backup.exe" C:\Users\Admin\Pictures\Saved Pictures\
                                                                                                                          7⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          PID:1524
                                                                                                                      • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                        "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                        6⤵
                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                        • System policy modification
                                                                                                                        PID:2012
                                                                                                                      • C:\Users\Admin\Searches\backup.exe
                                                                                                                        C:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\
                                                                                                                        6⤵
                                                                                                                          PID:1932
                                                                                                                        • C:\Users\Admin\Videos\backup.exe
                                                                                                                          C:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\
                                                                                                                          6⤵
                                                                                                                            PID:3500
                                                                                                                        • C:\Users\Public\backup.exe
                                                                                                                          C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                          5⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          PID:4312
                                                                                                                          • C:\Users\Public\Documents\backup.exe
                                                                                                                            C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                            6⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • System policy modification
                                                                                                                            PID:2868
                                                                                                                          • C:\Users\Public\Downloads\backup.exe
                                                                                                                            C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                            6⤵
                                                                                                                              PID:1536
                                                                                                                            • C:\Users\Public\Music\backup.exe
                                                                                                                              C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                              6⤵
                                                                                                                              • System policy modification
                                                                                                                              PID:1164
                                                                                                                            • C:\Users\Public\Pictures\backup.exe
                                                                                                                              C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                              6⤵
                                                                                                                                PID:1844
                                                                                                                              • C:\Users\Public\Videos\backup.exe
                                                                                                                                C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                6⤵
                                                                                                                                  PID:1808
                                                                                                                            • C:\Windows\backup.exe
                                                                                                                              C:\Windows\backup.exe C:\Windows\
                                                                                                                              4⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:4372
                                                                                                                              • C:\Windows\addins\System Restore.exe
                                                                                                                                "C:\Windows\addins\System Restore.exe" C:\Windows\addins\
                                                                                                                                5⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                PID:1836
                                                                                                                              • C:\Windows\appcompat\backup.exe
                                                                                                                                C:\Windows\appcompat\backup.exe C:\Windows\appcompat\
                                                                                                                                5⤵
                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:4988
                                                                                                                                • C:\Windows\appcompat\appraiser\backup.exe
                                                                                                                                  C:\Windows\appcompat\appraiser\backup.exe C:\Windows\appcompat\appraiser\
                                                                                                                                  6⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:1096
                                                                                                                                  • C:\Windows\appcompat\appraiser\Telemetry\backup.exe
                                                                                                                                    C:\Windows\appcompat\appraiser\Telemetry\backup.exe C:\Windows\appcompat\appraiser\Telemetry\
                                                                                                                                    7⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • System policy modification
                                                                                                                                    PID:5088
                                                                                                                                • C:\Windows\appcompat\encapsulation\backup.exe
                                                                                                                                  C:\Windows\appcompat\encapsulation\backup.exe C:\Windows\appcompat\encapsulation\
                                                                                                                                  6⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:5100
                                                                                                                                • C:\Windows\appcompat\Programs\backup.exe
                                                                                                                                  C:\Windows\appcompat\Programs\backup.exe C:\Windows\appcompat\Programs\
                                                                                                                                  6⤵
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:4044
                                                                                                                              • C:\Windows\apppatch\backup.exe
                                                                                                                                C:\Windows\apppatch\backup.exe C:\Windows\apppatch\
                                                                                                                                5⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5044
                                                                                                                                • C:\Windows\apppatch\AppPatch64\backup.exe
                                                                                                                                  C:\Windows\apppatch\AppPatch64\backup.exe C:\Windows\apppatch\AppPatch64\
                                                                                                                                  6⤵
                                                                                                                                  • System policy modification
                                                                                                                                  PID:3332
                                                                                                                                • C:\Windows\apppatch\Custom\backup.exe
                                                                                                                                  C:\Windows\apppatch\Custom\backup.exe C:\Windows\apppatch\Custom\
                                                                                                                                  6⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:1904
                                                                                                                                  • C:\Windows\apppatch\Custom\Custom64\backup.exe
                                                                                                                                    C:\Windows\apppatch\Custom\Custom64\backup.exe C:\Windows\apppatch\Custom\Custom64\
                                                                                                                                    7⤵
                                                                                                                                      PID:1928
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:4860
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3620
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3400
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            • System policy modification
                                                                                                                            PID:2676
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                            2⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3972
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                            2⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                            PID:3648

                                                                                                                        Network

                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                        Replay Monitor

                                                                                                                        Loading Replay Monitor...

                                                                                                                        Downloads

                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          bb1c9fccbe63d9b8262b3ba688c4c571

                                                                                                                          SHA1

                                                                                                                          aa80646bfc4beb767849024b174ee0f63caac4bf

                                                                                                                          SHA256

                                                                                                                          b1632cd907fa7ec3458c9ecf9c4dc96c3f2a7882bc3af9c87fbd161bf505426c

                                                                                                                          SHA512

                                                                                                                          970d4bb86b9e7e3f437ae1c131874b8d8fa259f4f856ca8e1dd5cd37bdd663f4cf2c6b2fccff049b8ffddc5237a438c26b720f3ae4e96b81b5302812c3516a94

                                                                                                                          Download Submit

                                                                                                                        • C:\PerfLogs\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          bb1c9fccbe63d9b8262b3ba688c4c571

                                                                                                                          SHA1

                                                                                                                          aa80646bfc4beb767849024b174ee0f63caac4bf

                                                                                                                          SHA256

                                                                                                                          b1632cd907fa7ec3458c9ecf9c4dc96c3f2a7882bc3af9c87fbd161bf505426c

                                                                                                                          SHA512

                                                                                                                          970d4bb86b9e7e3f437ae1c131874b8d8fa259f4f856ca8e1dd5cd37bdd663f4cf2c6b2fccff049b8ffddc5237a438c26b720f3ae4e96b81b5302812c3516a94

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          f31a43c70f35d5ff7f4e905e5ef89353

                                                                                                                          SHA1

                                                                                                                          d4507b836b2105eb5b0663076cb1128e805241e8

                                                                                                                          SHA256

                                                                                                                          af20d98aeb54698e64827d9bd0ee24eeeb89503e6b0199035bcd6f19c044b575

                                                                                                                          SHA512

                                                                                                                          e3991b34de75886134a8bb37175b64852f8933babdcb50a53134903b9a6f7956472e913837bffedf417a79d53259b36b6b5b5bff44ed36bd94d602ffad3c96cb

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          f31a43c70f35d5ff7f4e905e5ef89353

                                                                                                                          SHA1

                                                                                                                          d4507b836b2105eb5b0663076cb1128e805241e8

                                                                                                                          SHA256

                                                                                                                          af20d98aeb54698e64827d9bd0ee24eeeb89503e6b0199035bcd6f19c044b575

                                                                                                                          SHA512

                                                                                                                          e3991b34de75886134a8bb37175b64852f8933babdcb50a53134903b9a6f7956472e913837bffedf417a79d53259b36b6b5b5bff44ed36bd94d602ffad3c96cb

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          166920ce5bd3bd08d8cf47fab431f182

                                                                                                                          SHA1

                                                                                                                          2778fa94e3704784906164dfe7601d8f98bdaab2

                                                                                                                          SHA256

                                                                                                                          35f7e7ff8f3009545b26ea63ca2ca45b3ff954d12fc07b23eb79d5530d1d1942

                                                                                                                          SHA512

                                                                                                                          5ec4c05ee4c036963dc3a6172d02286b245fbb83ddd076b5a926155e1f1574f019d396ea08b1e4d6a93e2ad0d194fb36a4268a0bc7a94470cd9317403d7aee96

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          166920ce5bd3bd08d8cf47fab431f182

                                                                                                                          SHA1

                                                                                                                          2778fa94e3704784906164dfe7601d8f98bdaab2

                                                                                                                          SHA256

                                                                                                                          35f7e7ff8f3009545b26ea63ca2ca45b3ff954d12fc07b23eb79d5530d1d1942

                                                                                                                          SHA512

                                                                                                                          5ec4c05ee4c036963dc3a6172d02286b245fbb83ddd076b5a926155e1f1574f019d396ea08b1e4d6a93e2ad0d194fb36a4268a0bc7a94470cd9317403d7aee96

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          9ee604fd66823db84476b1bcbbae9d2d

                                                                                                                          SHA1

                                                                                                                          88196d0647bfe92e0ab204a8356f97165fdc7970

                                                                                                                          SHA256

                                                                                                                          14e6db054abcb287543a85ccc15dee4a35514a42e9ec233e119230161b40d131

                                                                                                                          SHA512

                                                                                                                          5246f8b7aa6bf44d0ce038e1cebaa848ff899b051205793719dfe1fead98cd069904037fc8ea1f9ee7ebec92e03085dc258039d5956802bbaf2721a9d6f7b2ac

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          9ee604fd66823db84476b1bcbbae9d2d

                                                                                                                          SHA1

                                                                                                                          88196d0647bfe92e0ab204a8356f97165fdc7970

                                                                                                                          SHA256

                                                                                                                          14e6db054abcb287543a85ccc15dee4a35514a42e9ec233e119230161b40d131

                                                                                                                          SHA512

                                                                                                                          5246f8b7aa6bf44d0ce038e1cebaa848ff899b051205793719dfe1fead98cd069904037fc8ea1f9ee7ebec92e03085dc258039d5956802bbaf2721a9d6f7b2ac

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          84af851675700e5951bfc9a615e13bb5

                                                                                                                          SHA1

                                                                                                                          053607bd95fdf8d0f663c6808febc0871464b864

                                                                                                                          SHA256

                                                                                                                          3887b699b904dd1a8eae69baa6b2e3fee5905925934f909961501c4eeb747187

                                                                                                                          SHA512

                                                                                                                          f6e1b3a5a07ce32bac4fbdac4b46970c495786e8229a05105995ae03a1939250e924915690f47b0ee2ede58a3607ccc4afb6b193096be8805789d02143f9a705

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\DESIGNER\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          84af851675700e5951bfc9a615e13bb5

                                                                                                                          SHA1

                                                                                                                          053607bd95fdf8d0f663c6808febc0871464b864

                                                                                                                          SHA256

                                                                                                                          3887b699b904dd1a8eae69baa6b2e3fee5905925934f909961501c4eeb747187

                                                                                                                          SHA512

                                                                                                                          f6e1b3a5a07ce32bac4fbdac4b46970c495786e8229a05105995ae03a1939250e924915690f47b0ee2ede58a3607ccc4afb6b193096be8805789d02143f9a705

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\Services\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          c90a2259b351b7a0058b6d88908cb808

                                                                                                                          SHA1

                                                                                                                          d5691d617692104e0bc838a974220ca2e7d78928

                                                                                                                          SHA256

                                                                                                                          ee94c53454c643d3a5b0f4a7204ac2d171a5d7d3dbceffe94c657b58bdea18e2

                                                                                                                          SHA512

                                                                                                                          d079491ea62a8aba153bc6b04ce1f9905550c9d41fe27a85166bbc413dbef9df9b76a9161a23b681d29372ac54a428bbd349efcf6b96568a2c8cb9af38d8684f

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\Services\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          c90a2259b351b7a0058b6d88908cb808

                                                                                                                          SHA1

                                                                                                                          d5691d617692104e0bc838a974220ca2e7d78928

                                                                                                                          SHA256

                                                                                                                          ee94c53454c643d3a5b0f4a7204ac2d171a5d7d3dbceffe94c657b58bdea18e2

                                                                                                                          SHA512

                                                                                                                          d079491ea62a8aba153bc6b04ce1f9905550c9d41fe27a85166bbc413dbef9df9b76a9161a23b681d29372ac54a428bbd349efcf6b96568a2c8cb9af38d8684f

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\System\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          1604dbff85dca41fa731ce37ae72e8e1

                                                                                                                          SHA1

                                                                                                                          05d114f06150c29f22706d314dbea334d333430b

                                                                                                                          SHA256

                                                                                                                          357b342af03db104658049d610e164f97f30ffdee3c920ae2a6ff5f59fcb4c47

                                                                                                                          SHA512

                                                                                                                          5d33c1788eed56574b14ef0080e3291554a96fa516024dd6396525394351200517bf217e1de60d48ab2f8dac50177beba85b635a9f61ff8e0f8c2a1940b2b0d6

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\System\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          1604dbff85dca41fa731ce37ae72e8e1

                                                                                                                          SHA1

                                                                                                                          05d114f06150c29f22706d314dbea334d333430b

                                                                                                                          SHA256

                                                                                                                          357b342af03db104658049d610e164f97f30ffdee3c920ae2a6ff5f59fcb4c47

                                                                                                                          SHA512

                                                                                                                          5d33c1788eed56574b14ef0080e3291554a96fa516024dd6396525394351200517bf217e1de60d48ab2f8dac50177beba85b635a9f61ff8e0f8c2a1940b2b0d6

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          18ef98f7a5c6db20666d59d9498d13bd

                                                                                                                          SHA1

                                                                                                                          ffc397dda95607b2ae5e25d4dea35a78940df4cf

                                                                                                                          SHA256

                                                                                                                          52000184b7cc8671923fdb9f7f130ee8bf0a21e14d978a15dbb72afaef551f53

                                                                                                                          SHA512

                                                                                                                          aada939201448685ae124a39430c5fea296e0d122299ce4508e71ec8dc6599c81fe65884c7efca47127160f3546f5c1efe4bc454bc295e1c5c55790f4e74fb23

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          18ef98f7a5c6db20666d59d9498d13bd

                                                                                                                          SHA1

                                                                                                                          ffc397dda95607b2ae5e25d4dea35a78940df4cf

                                                                                                                          SHA256

                                                                                                                          52000184b7cc8671923fdb9f7f130ee8bf0a21e14d978a15dbb72afaef551f53

                                                                                                                          SHA512

                                                                                                                          aada939201448685ae124a39430c5fea296e0d122299ce4508e71ec8dc6599c81fe65884c7efca47127160f3546f5c1efe4bc454bc295e1c5c55790f4e74fb23

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          9beb5a5867c41af7f4e076e2ac62697c

                                                                                                                          SHA1

                                                                                                                          fdf18b1273c2133b1f0530f7d1e8bd5ceb88b389

                                                                                                                          SHA256

                                                                                                                          06606624ff92ca9fa1c04c667e45e6fb3a4b843d3084982c1e835f099a92fc8b

                                                                                                                          SHA512

                                                                                                                          d90cad427bc2ef71b235a0031cb3d36017e9c6677002bf03b0a02292d47e7643269894d5aa00d39d6cadcf78e235130fe56a9387916dff9b3e0adf52cdd8f703

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          9beb5a5867c41af7f4e076e2ac62697c

                                                                                                                          SHA1

                                                                                                                          fdf18b1273c2133b1f0530f7d1e8bd5ceb88b389

                                                                                                                          SHA256

                                                                                                                          06606624ff92ca9fa1c04c667e45e6fb3a4b843d3084982c1e835f099a92fc8b

                                                                                                                          SHA512

                                                                                                                          d90cad427bc2ef71b235a0031cb3d36017e9c6677002bf03b0a02292d47e7643269894d5aa00d39d6cadcf78e235130fe56a9387916dff9b3e0adf52cdd8f703

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          a2dce49d6f1003723d0e4ce633c7b3a5

                                                                                                                          SHA1

                                                                                                                          ea6170437ade55fa7cb8612b8e58b83852d1664c

                                                                                                                          SHA256

                                                                                                                          d33eb18b81364158885998304a3438bf1dffb017a4731aad6497e5f2dd97530c

                                                                                                                          SHA512

                                                                                                                          7dcc6fc6a3fd32c21984537b7008e2a40dd5c8b6d10372c53fe2a058b0cc2e3e2060d64a71f32e2f37cb5879679ff94d79103839f5b2bb8c9ee9eabc646f5e68

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          a2dce49d6f1003723d0e4ce633c7b3a5

                                                                                                                          SHA1

                                                                                                                          ea6170437ade55fa7cb8612b8e58b83852d1664c

                                                                                                                          SHA256

                                                                                                                          d33eb18b81364158885998304a3438bf1dffb017a4731aad6497e5f2dd97530c

                                                                                                                          SHA512

                                                                                                                          7dcc6fc6a3fd32c21984537b7008e2a40dd5c8b6d10372c53fe2a058b0cc2e3e2060d64a71f32e2f37cb5879679ff94d79103839f5b2bb8c9ee9eabc646f5e68

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\update.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ceb0a84ffb896f5556ab9a25c5f0139b

                                                                                                                          SHA1

                                                                                                                          302b741ce808aead58ba8a043a8926b7f6b781b3

                                                                                                                          SHA256

                                                                                                                          4d754580544a7708ce304948a6128e3921681192fa6c00900186c0173b9c06b4

                                                                                                                          SHA512

                                                                                                                          e3e25ee226581b7de96a199dcf9c44d38de505219152127f1cfafbbd73a2f3cb40499de285ffd8b3f7b9798fa880064a0e51b027094c158122288625a596ef99

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\update.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ceb0a84ffb896f5556ab9a25c5f0139b

                                                                                                                          SHA1

                                                                                                                          302b741ce808aead58ba8a043a8926b7f6b781b3

                                                                                                                          SHA256

                                                                                                                          4d754580544a7708ce304948a6128e3921681192fa6c00900186c0173b9c06b4

                                                                                                                          SHA512

                                                                                                                          e3e25ee226581b7de96a199dcf9c44d38de505219152127f1cfafbbd73a2f3cb40499de285ffd8b3f7b9798fa880064a0e51b027094c158122288625a596ef99

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ea9d5d1ec57ffa00207a44445f7fac55

                                                                                                                          SHA1

                                                                                                                          7b60d1b6787abee13c9e472ff5fbe3dd246acaa3

                                                                                                                          SHA256

                                                                                                                          69483a7013579ff58beef40647a5599fea284ad3e964787e343f29d2784c8ce0

                                                                                                                          SHA512

                                                                                                                          d4d893916291e6ac2359f91ea697453d43fc270ecbe579c8212f8ad6146aa59c5a7252ea0f6bfd5a9f66056750ac3cbfb613a35c847ab086d05abc3a13e649e5

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ea9d5d1ec57ffa00207a44445f7fac55

                                                                                                                          SHA1

                                                                                                                          7b60d1b6787abee13c9e472ff5fbe3dd246acaa3

                                                                                                                          SHA256

                                                                                                                          69483a7013579ff58beef40647a5599fea284ad3e964787e343f29d2784c8ce0

                                                                                                                          SHA512

                                                                                                                          d4d893916291e6ac2359f91ea697453d43fc270ecbe579c8212f8ad6146aa59c5a7252ea0f6bfd5a9f66056750ac3cbfb613a35c847ab086d05abc3a13e649e5

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          20ef691092455cae72f58565229217d5

                                                                                                                          SHA1

                                                                                                                          22a1ccc32e6bc96a6bf696a82faf72c470d7b993

                                                                                                                          SHA256

                                                                                                                          d42daba0fe01f25de8f1af77f4eaac3f28771fb829a34aa107226f41da163201

                                                                                                                          SHA512

                                                                                                                          7db4047f9e40e898a5e47791b10ae5b31939ba658898dc9a1d2a3a9ed00a33a2ecadc81a4d8abf9472f6fc452e1d2e09f0ac264c939ea0817ecd3b9bcc12ef9e

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\OFFICE16\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          20ef691092455cae72f58565229217d5

                                                                                                                          SHA1

                                                                                                                          22a1ccc32e6bc96a6bf696a82faf72c470d7b993

                                                                                                                          SHA256

                                                                                                                          d42daba0fe01f25de8f1af77f4eaac3f28771fb829a34aa107226f41da163201

                                                                                                                          SHA512

                                                                                                                          7db4047f9e40e898a5e47791b10ae5b31939ba658898dc9a1d2a3a9ed00a33a2ecadc81a4d8abf9472f6fc452e1d2e09f0ac264c939ea0817ecd3b9bcc12ef9e

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          84af851675700e5951bfc9a615e13bb5

                                                                                                                          SHA1

                                                                                                                          053607bd95fdf8d0f663c6808febc0871464b864

                                                                                                                          SHA256

                                                                                                                          3887b699b904dd1a8eae69baa6b2e3fee5905925934f909961501c4eeb747187

                                                                                                                          SHA512

                                                                                                                          f6e1b3a5a07ce32bac4fbdac4b46970c495786e8229a05105995ae03a1939250e924915690f47b0ee2ede58a3607ccc4afb6b193096be8805789d02143f9a705

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          84af851675700e5951bfc9a615e13bb5

                                                                                                                          SHA1

                                                                                                                          053607bd95fdf8d0f663c6808febc0871464b864

                                                                                                                          SHA256

                                                                                                                          3887b699b904dd1a8eae69baa6b2e3fee5905925934f909961501c4eeb747187

                                                                                                                          SHA512

                                                                                                                          f6e1b3a5a07ce32bac4fbdac4b46970c495786e8229a05105995ae03a1939250e924915690f47b0ee2ede58a3607ccc4afb6b193096be8805789d02143f9a705

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          3cc51bd6b2c09bcd001b678ebd5605de

                                                                                                                          SHA1

                                                                                                                          0b1b45497906b670280e347c31d27dbe49f0e94d

                                                                                                                          SHA256

                                                                                                                          bbbd3a94ef48a7b45d5bb34b6c937509144adbb8eff6674f97a6d2ae84a5a25e

                                                                                                                          SHA512

                                                                                                                          7cf5ed313bb6b56484ca0d084840cddb5673b2c211be80c215b11a4559dbe769638f55b62081229bba58d05feab385522b482abe4b8eedfd35a2fe361cc7260b

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\ar-SA\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          3cc51bd6b2c09bcd001b678ebd5605de

                                                                                                                          SHA1

                                                                                                                          0b1b45497906b670280e347c31d27dbe49f0e94d

                                                                                                                          SHA256

                                                                                                                          bbbd3a94ef48a7b45d5bb34b6c937509144adbb8eff6674f97a6d2ae84a5a25e

                                                                                                                          SHA512

                                                                                                                          7cf5ed313bb6b56484ca0d084840cddb5673b2c211be80c215b11a4559dbe769638f55b62081229bba58d05feab385522b482abe4b8eedfd35a2fe361cc7260b

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          00fc91653977499cfa3706bced0f6013

                                                                                                                          SHA1

                                                                                                                          e686f84eca7db6cda968a1e2ff998aba479a15d8

                                                                                                                          SHA256

                                                                                                                          31870ca9012633265c07bbabcbc17175ec917af05d30cf27c6f051176406b7e1

                                                                                                                          SHA512

                                                                                                                          d153eb7962733070611df538b6e19db9897eeeba7f8b5e6979f3c11d5b7861718b2ecf6eea888c358db4c2797dce4a1030b981e008902507ab0587220daf481f

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          00fc91653977499cfa3706bced0f6013

                                                                                                                          SHA1

                                                                                                                          e686f84eca7db6cda968a1e2ff998aba479a15d8

                                                                                                                          SHA256

                                                                                                                          31870ca9012633265c07bbabcbc17175ec917af05d30cf27c6f051176406b7e1

                                                                                                                          SHA512

                                                                                                                          d153eb7962733070611df538b6e19db9897eeeba7f8b5e6979f3c11d5b7861718b2ecf6eea888c358db4c2797dce4a1030b981e008902507ab0587220daf481f

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          3cc51bd6b2c09bcd001b678ebd5605de

                                                                                                                          SHA1

                                                                                                                          0b1b45497906b670280e347c31d27dbe49f0e94d

                                                                                                                          SHA256

                                                                                                                          bbbd3a94ef48a7b45d5bb34b6c937509144adbb8eff6674f97a6d2ae84a5a25e

                                                                                                                          SHA512

                                                                                                                          7cf5ed313bb6b56484ca0d084840cddb5673b2c211be80c215b11a4559dbe769638f55b62081229bba58d05feab385522b482abe4b8eedfd35a2fe361cc7260b

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          3cc51bd6b2c09bcd001b678ebd5605de

                                                                                                                          SHA1

                                                                                                                          0b1b45497906b670280e347c31d27dbe49f0e94d

                                                                                                                          SHA256

                                                                                                                          bbbd3a94ef48a7b45d5bb34b6c937509144adbb8eff6674f97a6d2ae84a5a25e

                                                                                                                          SHA512

                                                                                                                          7cf5ed313bb6b56484ca0d084840cddb5673b2c211be80c215b11a4559dbe769638f55b62081229bba58d05feab385522b482abe4b8eedfd35a2fe361cc7260b

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          51bbdd6c34c70197a0931c0203159e9f

                                                                                                                          SHA1

                                                                                                                          83af030093af7e5eaa89f51ca2ae298560cf351f

                                                                                                                          SHA256

                                                                                                                          e63ad91e9d641cb929677c083d6e20c050af9e3e1b83c3a61c985b4c76ba1e64

                                                                                                                          SHA512

                                                                                                                          612613ef424c89e22531793f7855f831cafbadd915f6663293534db8cfeb8d9ba81443879c656c16a75d6f87b50cf1e6c37b39e0f3f741fd258f203a7f39cb74

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          51bbdd6c34c70197a0931c0203159e9f

                                                                                                                          SHA1

                                                                                                                          83af030093af7e5eaa89f51ca2ae298560cf351f

                                                                                                                          SHA256

                                                                                                                          e63ad91e9d641cb929677c083d6e20c050af9e3e1b83c3a61c985b4c76ba1e64

                                                                                                                          SHA512

                                                                                                                          612613ef424c89e22531793f7855f831cafbadd915f6663293534db8cfeb8d9ba81443879c656c16a75d6f87b50cf1e6c37b39e0f3f741fd258f203a7f39cb74

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          63aafb68c5a47e24a9746a4d936074a4

                                                                                                                          SHA1

                                                                                                                          d031525bf81a6839373b174148f287fcbc04c198

                                                                                                                          SHA256

                                                                                                                          bc5ad6796334106cbe52fc7c2e21e14a414221f26edffb621182151943a32748

                                                                                                                          SHA512

                                                                                                                          dc0a99aeb8b7e198d2ea08a8dc671669e90d95ba31d3e4d8da542ac0adfd0e17c7738e4bcf0fcf41250acf2fad5dd1bab6170960e9db8b8fd0d7b91afc25251e

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          63aafb68c5a47e24a9746a4d936074a4

                                                                                                                          SHA1

                                                                                                                          d031525bf81a6839373b174148f287fcbc04c198

                                                                                                                          SHA256

                                                                                                                          bc5ad6796334106cbe52fc7c2e21e14a414221f26edffb621182151943a32748

                                                                                                                          SHA512

                                                                                                                          dc0a99aeb8b7e198d2ea08a8dc671669e90d95ba31d3e4d8da542ac0adfd0e17c7738e4bcf0fcf41250acf2fad5dd1bab6170960e9db8b8fd0d7b91afc25251e

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Google\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ac624a7142a507513a51a46bc1f2180e

                                                                                                                          SHA1

                                                                                                                          b857ced1640f70a359550666018aa680c444101c

                                                                                                                          SHA256

                                                                                                                          20f2337c01a7eaed565ba4d2317c91475ee03d40666d841008b042c9e4d06fff

                                                                                                                          SHA512

                                                                                                                          26bdf4bdf219ed80baab85f1db0e843c2ddc972d4c3e6015ca07d4feb15cab00f6a7bdb83b01bfe51359d02442f7dd3b03352aee27fdf6649a8ddf7b085a6fac

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Google\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ac624a7142a507513a51a46bc1f2180e

                                                                                                                          SHA1

                                                                                                                          b857ced1640f70a359550666018aa680c444101c

                                                                                                                          SHA256

                                                                                                                          20f2337c01a7eaed565ba4d2317c91475ee03d40666d841008b042c9e4d06fff

                                                                                                                          SHA512

                                                                                                                          26bdf4bdf219ed80baab85f1db0e843c2ddc972d4c3e6015ca07d4feb15cab00f6a7bdb83b01bfe51359d02442f7dd3b03352aee27fdf6649a8ddf7b085a6fac

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          6442218021ec0005c72ed4cf974a558d

                                                                                                                          SHA1

                                                                                                                          0dc771d840aee9387ab977429a459b2ede4503c3

                                                                                                                          SHA256

                                                                                                                          6a6f249813f894856f3f57df2c29408ea59463868d2fd0942d35f1be5347e3d1

                                                                                                                          SHA512

                                                                                                                          27188f60132b33e062f4c02d6cc3ebe04032f9feca3e441d669af21fa74c804fe0dfe9d24c45982b60a37bcfb8e5c13f995fd1a16cf00610b23de5decd10ed7a

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          6442218021ec0005c72ed4cf974a558d

                                                                                                                          SHA1

                                                                                                                          0dc771d840aee9387ab977429a459b2ede4503c3

                                                                                                                          SHA256

                                                                                                                          6a6f249813f894856f3f57df2c29408ea59463868d2fd0942d35f1be5347e3d1

                                                                                                                          SHA512

                                                                                                                          27188f60132b33e062f4c02d6cc3ebe04032f9feca3e441d669af21fa74c804fe0dfe9d24c45982b60a37bcfb8e5c13f995fd1a16cf00610b23de5decd10ed7a

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          358e8a712be1af08d8624bc1516bc300

                                                                                                                          SHA1

                                                                                                                          4f442975a623d205e709d81630368f8224efcf5b

                                                                                                                          SHA256

                                                                                                                          69876bd732e437faf777db078b10d83fffc04be455232306d4b482c06a73c657

                                                                                                                          SHA512

                                                                                                                          8e82fc44b596295ca2c6c136b0bd51deeffb25d868750fc26445497dccb329a9d72b0794f9f558431aaf40617936c621d22149860c22e8ce4ba3744cd1f4a574

                                                                                                                          Download Submit

                                                                                                                        • C:\Program Files\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          358e8a712be1af08d8624bc1516bc300

                                                                                                                          SHA1

                                                                                                                          4f442975a623d205e709d81630368f8224efcf5b

                                                                                                                          SHA256

                                                                                                                          69876bd732e437faf777db078b10d83fffc04be455232306d4b482c06a73c657

                                                                                                                          SHA512

                                                                                                                          8e82fc44b596295ca2c6c136b0bd51deeffb25d868750fc26445497dccb329a9d72b0794f9f558431aaf40617936c621d22149860c22e8ce4ba3744cd1f4a574

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3327237043\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\3327237043\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          95e412ed9924ef2e8937959ac289b8d0

                                                                                                                          SHA1

                                                                                                                          c804f676fed3f275fd9cac19f2d4894baefc2a06

                                                                                                                          SHA256

                                                                                                                          463c2c1e1a313089685a21dc06034129a821bbe297ca3eea87290f1f654f3e6e

                                                                                                                          SHA512

                                                                                                                          7d63242cc9b8b3731787a0803382d890603c0b790560d43e7bf8222ee7e29c0e57fc9940d1963df2e5ac345503de681117038fd5b4a72b031f57fe07445be022

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          95e412ed9924ef2e8937959ac289b8d0

                                                                                                                          SHA1

                                                                                                                          c804f676fed3f275fd9cac19f2d4894baefc2a06

                                                                                                                          SHA256

                                                                                                                          463c2c1e1a313089685a21dc06034129a821bbe297ca3eea87290f1f654f3e6e

                                                                                                                          SHA512

                                                                                                                          7d63242cc9b8b3731787a0803382d890603c0b790560d43e7bf8222ee7e29c0e57fc9940d1963df2e5ac345503de681117038fd5b4a72b031f57fe07445be022

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ffaf27afe9b1d0ca5e32743bfee32f64

                                                                                                                          SHA1

                                                                                                                          e0ee9fe275e49c093a0cecb286c39300f3128c86

                                                                                                                          SHA256

                                                                                                                          20c24bffd89ed3bea53f4664835086bef85cc5dd2d41223e62d43dacd1a033b6

                                                                                                                          SHA512

                                                                                                                          02fea8b650de83f46d91aa2b6ba7a99b69d950b355a882685d12f3a5eb214e639eb4b7e91aef52a97f73310d237e335c60ed6f459c77127c9bada897c2283f1f

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          95e412ed9924ef2e8937959ac289b8d0

                                                                                                                          SHA1

                                                                                                                          c804f676fed3f275fd9cac19f2d4894baefc2a06

                                                                                                                          SHA256

                                                                                                                          463c2c1e1a313089685a21dc06034129a821bbe297ca3eea87290f1f654f3e6e

                                                                                                                          SHA512

                                                                                                                          7d63242cc9b8b3731787a0803382d890603c0b790560d43e7bf8222ee7e29c0e57fc9940d1963df2e5ac345503de681117038fd5b4a72b031f57fe07445be022

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          95e412ed9924ef2e8937959ac289b8d0

                                                                                                                          SHA1

                                                                                                                          c804f676fed3f275fd9cac19f2d4894baefc2a06

                                                                                                                          SHA256

                                                                                                                          463c2c1e1a313089685a21dc06034129a821bbe297ca3eea87290f1f654f3e6e

                                                                                                                          SHA512

                                                                                                                          7d63242cc9b8b3731787a0803382d890603c0b790560d43e7bf8222ee7e29c0e57fc9940d1963df2e5ac345503de681117038fd5b4a72b031f57fe07445be022

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ce60eb025314576cf989b647bc06a24f

                                                                                                                          SHA1

                                                                                                                          4611a3ab637f426fd4935ac83d00079b0d2c92e0

                                                                                                                          SHA256

                                                                                                                          24330d99df66609f3223fd1218d1d2a2cffad33b53616d9b72d1dde0e740bfb5

                                                                                                                          SHA512

                                                                                                                          73e37ed85672cb15128f16d01ef86f4a193210499136e26c57385866e459429902191a6e3491ee3f940c7d343f510b3b833896e13657e4459a46b1697183d1c4

                                                                                                                          Download Submit

                                                                                                                        • C:\Users\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          ce60eb025314576cf989b647bc06a24f

                                                                                                                          SHA1

                                                                                                                          4611a3ab637f426fd4935ac83d00079b0d2c92e0

                                                                                                                          SHA256

                                                                                                                          24330d99df66609f3223fd1218d1d2a2cffad33b53616d9b72d1dde0e740bfb5

                                                                                                                          SHA512

                                                                                                                          73e37ed85672cb15128f16d01ef86f4a193210499136e26c57385866e459429902191a6e3491ee3f940c7d343f510b3b833896e13657e4459a46b1697183d1c4

                                                                                                                          Download Submit

                                                                                                                        • C:\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          833940a1357210b89164048783108c55

                                                                                                                          SHA1

                                                                                                                          9db08c759941cd99f38e1b87b82221408a016d3a

                                                                                                                          SHA256

                                                                                                                          4b9fd68405ee5ad869dc4d06c5be0b0dc8bba3feb71dd2b18ad667a08a6be9cc

                                                                                                                          SHA512

                                                                                                                          1e1570ce9db855163e22f70da0ccce3138ebeefd9d481b0ced560f2d04cb0f832f72d89f93020f6599e35a15762b44512c33440633d731297202773949572d35

                                                                                                                          Download Submit

                                                                                                                        • C:\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          833940a1357210b89164048783108c55

                                                                                                                          SHA1

                                                                                                                          9db08c759941cd99f38e1b87b82221408a016d3a

                                                                                                                          SHA256

                                                                                                                          4b9fd68405ee5ad869dc4d06c5be0b0dc8bba3feb71dd2b18ad667a08a6be9cc

                                                                                                                          SHA512

                                                                                                                          1e1570ce9db855163e22f70da0ccce3138ebeefd9d481b0ced560f2d04cb0f832f72d89f93020f6599e35a15762b44512c33440633d731297202773949572d35

                                                                                                                          Download Submit

                                                                                                                        • C:\odt\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          cad27be086f3c38e399d37b8d791a3b0

                                                                                                                          SHA1

                                                                                                                          80a68124f2b04e9009e9113a37c09961afb8821d

                                                                                                                          SHA256

                                                                                                                          e6146a0e5ca85e31f4086e72fa93319b9733e45f85734152669938ed6f47eb4c

                                                                                                                          SHA512

                                                                                                                          8fef49c7c0dab0d237e3e8f591517356837b408c71b2a5cc06da4f854cad6bf0a41a6a14ab4eb708d6da9bcbab25f913586354f3e2136e95d9179a4e893bb91e

                                                                                                                          Download Submit

                                                                                                                        • C:\odt\backup.exe
                                                                                                                          Filesize

                                                                                                                          72KB

                                                                                                                          MD5

                                                                                                                          cad27be086f3c38e399d37b8d791a3b0

                                                                                                                          SHA1

                                                                                                                          80a68124f2b04e9009e9113a37c09961afb8821d

                                                                                                                          SHA256

                                                                                                                          e6146a0e5ca85e31f4086e72fa93319b9733e45f85734152669938ed6f47eb4c

                                                                                                                          SHA512

                                                                                                                          8fef49c7c0dab0d237e3e8f591517356837b408c71b2a5cc06da4f854cad6bf0a41a6a14ab4eb708d6da9bcbab25f913586354f3e2136e95d9179a4e893bb91e

                                                                                                                          Download Submit