7de0e07990cd241f8c9469b3daa6e666a1bc54cb9783ef5bd26f02c01b6316c3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
24/12/2023, 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0929bb6a57c1c5c382b09d4275f5d00b.exe
Size

116KB
MD5

0929bb6a57c1c5c382b09d4275f5d00b
SHA1

04641e94a774af9274741672c5c01b2a620696e6
SHA256

7de0e07990cd241f8c9469b3daa6e666a1bc54cb9783ef5bd26f02c01b6316c3
SHA512

9d8897e7731822e6d876a4099dede4b6a1af0c24ef3b96be7dc3dd1e60dc883663b7f481a0296a56b8698948b1ef8c5e96fc2e439486cd8b5a5450de5b298043
SSDEEP

3072:cVXgryXWDW6HVRhcLyhRh8mLXyiloJda:cdgPqIjhr3fyY

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
968	Process not Found
3988	Process not Found
3608	Process not Found
1256	Process not Found
4848	Process not Found
4092	Process not Found
5096	Process not Found
3432	Process not Found
3344	Process not Found
4656	Process not Found
4844	Process not Found
2184	Process not Found
3400	Process not Found
3660	Process not Found
2068	Process not Found
2352	Process not Found
4336	Process not Found
4552	Process not Found
1356	Process not Found
4420	Process not Found
4968	Process not Found
536	Process not Found
4896	Process not Found
4900	Process not Found
1276	Process not Found
4520	Process not Found
1040	Process not Found
2388	Process not Found
4028	Process not Found
3932	Process not Found
3928	Process not Found
4804	Process not Found
4752	Process not Found
1392	Process not Found
4032	Process not Found
3440	Process not Found
3148	Process not Found
772	Process not Found
4864	Process not Found
1984	Process not Found
3600	Process not Found
788	Process not Found
2472	Process not Found
4628	Process not Found
1952	Process not Found
4352	Process not Found
1280	Process not Found
2564	Process not Found
4180	Process not Found
1312	Process not Found
4036	Process not Found
2364	Process not Found
3304	Process not Found
3832	Process not Found
4428	Process not Found
3664	Process not Found
3292	Process not Found
2844	Process not Found
4904	Process not Found
2784	Process not Found
532	Process not Found
5096	Process not Found
5056	Process not Found
2292	Process not Found

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found
File created	C:\Windows\SysWOW64\setups.bak	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 968	2464	Process not Found	6743
PID 2464 wrote to memory of 968	2464	Process not Found	6743
PID 2464 wrote to memory of 968	2464	Process not Found	6743
PID 968 wrote to memory of 3988	968	Process not Found	6742
PID 968 wrote to memory of 3988	968	Process not Found	6742
PID 968 wrote to memory of 3988	968	Process not Found	6742
PID 3988 wrote to memory of 3608	3988	Process not Found	6741
PID 3988 wrote to memory of 3608	3988	Process not Found	6741
PID 3988 wrote to memory of 3608	3988	Process not Found	6741
PID 3608 wrote to memory of 1256	3608	Process not Found	6740
PID 3608 wrote to memory of 1256	3608	Process not Found	6740
PID 3608 wrote to memory of 1256	3608	Process not Found	6740
PID 1256 wrote to memory of 4848	1256	Process not Found	6739
PID 1256 wrote to memory of 4848	1256	Process not Found	6739
PID 1256 wrote to memory of 4848	1256	Process not Found	6739
PID 4848 wrote to memory of 4092	4848	Process not Found	6738
PID 4848 wrote to memory of 4092	4848	Process not Found	6738
PID 4848 wrote to memory of 4092	4848	Process not Found	6738
PID 4092 wrote to memory of 5096	4092	Process not Found	6737
PID 4092 wrote to memory of 5096	4092	Process not Found	6737
PID 4092 wrote to memory of 5096	4092	Process not Found	6737
PID 5096 wrote to memory of 3432	5096	Process not Found	6736
PID 5096 wrote to memory of 3432	5096	Process not Found	6736
PID 5096 wrote to memory of 3432	5096	Process not Found	6736
PID 3432 wrote to memory of 3344	3432	Process not Found	6735
PID 3432 wrote to memory of 3344	3432	Process not Found	6735
PID 3432 wrote to memory of 3344	3432	Process not Found	6735
PID 3344 wrote to memory of 4656	3344	Process not Found	6734
PID 3344 wrote to memory of 4656	3344	Process not Found	6734
PID 3344 wrote to memory of 4656	3344	Process not Found	6734
PID 4656 wrote to memory of 4844	4656	Process not Found	6733
PID 4656 wrote to memory of 4844	4656	Process not Found	6733
PID 4656 wrote to memory of 4844	4656	Process not Found	6733
PID 4844 wrote to memory of 2184	4844	Process not Found	6732
PID 4844 wrote to memory of 2184	4844	Process not Found	6732
PID 4844 wrote to memory of 2184	4844	Process not Found	6732
PID 2184 wrote to memory of 3400	2184	Process not Found	6731
PID 2184 wrote to memory of 3400	2184	Process not Found	6731
PID 2184 wrote to memory of 3400	2184	Process not Found	6731
PID 3400 wrote to memory of 3660	3400	Process not Found	6730
PID 3400 wrote to memory of 3660	3400	Process not Found	6730
PID 3400 wrote to memory of 3660	3400	Process not Found	6730
PID 3660 wrote to memory of 2068	3660	Process not Found	6729
PID 3660 wrote to memory of 2068	3660	Process not Found	6729
PID 3660 wrote to memory of 2068	3660	Process not Found	6729
PID 2068 wrote to memory of 2352	2068	Process not Found	6728
PID 2068 wrote to memory of 2352	2068	Process not Found	6728
PID 2068 wrote to memory of 2352	2068	Process not Found	6728
PID 2352 wrote to memory of 4336	2352	Process not Found	6727
PID 2352 wrote to memory of 4336	2352	Process not Found	6727
PID 2352 wrote to memory of 4336	2352	Process not Found	6727
PID 4336 wrote to memory of 4552	4336	Process not Found	6726
PID 4336 wrote to memory of 4552	4336	Process not Found	6726
PID 4336 wrote to memory of 4552	4336	Process not Found	6726
PID 4552 wrote to memory of 1356	4552	Process not Found	6725
PID 4552 wrote to memory of 1356	4552	Process not Found	6725
PID 4552 wrote to memory of 1356	4552	Process not Found	6725
PID 1356 wrote to memory of 4420	1356	Process not Found	6564
PID 1356 wrote to memory of 4420	1356	Process not Found	6564
PID 1356 wrote to memory of 4420	1356	Process not Found	6564
PID 4420 wrote to memory of 4968	4420	Process not Found	6873
PID 4420 wrote to memory of 4968	4420	Process not Found	6873
PID 4420 wrote to memory of 4968	4420	Process not Found	6873
PID 4968 wrote to memory of 536	4968	Process not Found	6962

C:\Users\Admin\AppData\Local\Temp\0929bb6a57c1c5c382b09d4275f5d00b.exe
"C:\Users\Admin\AppData\Local\Temp\0929bb6a57c1c5c382b09d4275f5d00b.exe"
1⤵
PID:1828

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4420
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4372

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4032
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3840
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2492
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4432
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3296
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1660
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3344
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3188

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1952
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3740
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3876
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3292
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4308

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1312
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4668

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1356
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4796
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2932
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3648
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4268
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2976
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2976
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3192

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3384

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4304

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4996
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1392
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3148
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:788
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3180
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:732
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2880
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3380
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1392
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3748
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1140
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:456

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2916

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4428
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4244
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5068
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3136

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2196

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:400

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3996

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:968

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2784

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1772

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4552

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2856

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2776

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4500
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1256

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2908

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4828

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5068
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4128

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1636
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3920

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4244

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3376

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3748

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3616
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3608
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2828
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3784
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4420
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4964
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3776
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4968
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        13⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        14⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4420
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3776
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:5060
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3776
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:5056
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4560
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2848
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:232

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4576

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3932
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4572

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2528

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4440
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3404
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2512
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5088
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1684

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3376
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1920

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4036

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4920
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4048

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1272

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2776

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2908

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2168

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1968

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2588
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3608
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2712
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3988
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1264
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4372
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:676
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1356

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2184

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2084
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4964
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4952
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3168
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1660
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1864
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:5112
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2196
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1332
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4420
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2576
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3048
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3048
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:5060
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2452
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:224
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3188
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:5116
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4060
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:2492
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3904
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4968
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3168
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3648
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4684
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:744
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:848
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:660
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4516

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4064

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3748

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:788

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3532
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3696

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4348
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1256
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4644
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:5096
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3940
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3160
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4092

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:664
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4548
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2196
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1188
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:536
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2552
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4968
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4620
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3168

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3912

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4984
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1828

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4060

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3652

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3740

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:792
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2184

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3180

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3096

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4580

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2196

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4356
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:536
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4944
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3180
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2000
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2912
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1520
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4496
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3828
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4268

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2976

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4632

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:932

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2916

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2824
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2296
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4988
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2472
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1256
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3104
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2916

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4740

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4884
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4668
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:5060
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3048
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4652

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2184

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3836
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3376

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4944

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1332
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3652

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3096
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3052
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4488
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4128
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1040

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4388

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3168
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2396
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4336
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2932

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4388

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2848
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3920

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4740

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:792

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2976
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1264
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4060

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3296

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3920
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1828
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:5060
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2588
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4432
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4884
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2544
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:232
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2788
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4652
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3988
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4676
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4372
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:1304
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4336
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:2452
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        13⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:536
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4284
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:4516
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        13⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        14⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        15⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        14⤵
        
        PID:1464
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:2396
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4900
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4664
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4060
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1764
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2848
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2932
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2524
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3744
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4048
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:116

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:792

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4520

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2856
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2564

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1692

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4084

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2068
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1304

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4060

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4572

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2000
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4580
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4308
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1812
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4244
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3432
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2364

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4048

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1264
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4572

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:232

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1828
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:664

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4516
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:404
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4520

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1272

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2352
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1372
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1524
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4036
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3600
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3556
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3304
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3104
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:5088

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4976
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:624
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1724
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1316
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4104
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1192
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3236
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4388
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3380
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1040
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4252

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3940

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4848
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1812
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3368
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3136
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1472
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4576
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:876
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1992
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:1868
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:688
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3616
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1684
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1984
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4328
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3136
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:688

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2364

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1164
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3380
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4180

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2364

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3236
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3652
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2836
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:868
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1724
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3932
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3836
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3204
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4068
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2880
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:5104
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:3204

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3696

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4668

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4392

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2564
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4628
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4576

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1868

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1508

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:436

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2552
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1164
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2912
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3076

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4392

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1144
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3988
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2492
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4048
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4560

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1764

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2512
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4668
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:636
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4652
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4168
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:636
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:688
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2212
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1200
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:232
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2356
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:3608
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3136
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4652
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:1508
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4804
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3832
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1256

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2472

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4464
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5096
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:532
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3532
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4308
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3368
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1868
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:532
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4084
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:8
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4884
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:2908
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        13⤵
        
        PID:4572
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:876
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2680
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4752
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1004

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2932

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3168
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4372
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4268
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1356
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2324
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1864

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3384
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3836

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1200

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4388
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2380
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3160
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3556
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4464
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:372

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1464

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3988

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2880

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4508
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:8
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4168
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1992
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4420
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4428
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3136
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3136
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2212

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1472
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4244

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2524
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4104

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3876
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1784
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4920
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4308

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1868
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4884

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4740
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4060
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4320

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4008

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4752
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:788
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2856
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4408
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3520
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1308
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:788
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4408
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2296
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4184
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4768
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1372
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2152
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3096
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4388
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2480
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4092
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:3556
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:1824
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:1040
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1256
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3204
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3132
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1004

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1316
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1520
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4808
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1932
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4808
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1524
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4988
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4672
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1524
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3436

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3776
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3648
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4320

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3740

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4988

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1156
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4804
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1392

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2152

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4084
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3696
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2512
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:688
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3368
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4308
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3136
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4752
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:688
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1508
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3616
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4160
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3920
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4884
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3616
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2356
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2356

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1932
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3436
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2152

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3940
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1952
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3876
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3368
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3532
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4308
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3136
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:636
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3368
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4668
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4428

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3048

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1200

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3648

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4408

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4140

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3168

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4180
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3376

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2880

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4580
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2212
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3268
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1612
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3132
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4488
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:2648
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4440
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:4036
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:3304
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4660
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:1256
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        13⤵
        
        PID:5084
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        14⤵
        
        PID:4864
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4828
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2384
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3436
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4036

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:848
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:660

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1256
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5068
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2544
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4432
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4048
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4964
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2848

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3132

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4572
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1312

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3924
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2824
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3408
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1372
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3096
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3940
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4184
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1040
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4644
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4140

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5084
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:232
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4084
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:456
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:676
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2512
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:876

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3904
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:208
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3904

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:456
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1312
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3616

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3784
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2356

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3376
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:660
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1332
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2976

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1188

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3204
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1692

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:868

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2364

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4060
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4968
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4320
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:5060
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3168
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1156
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1332
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3344
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4320
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3840

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:404

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3296
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2000
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4896
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:848

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4048
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4432
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:376
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4048

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4320
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1764
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4372

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3900
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1272

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3932
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4516
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2552
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:536
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1164
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3344
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:1392
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4484
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:1060
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4352
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:3316
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4776
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:432
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:1520
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3076
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:3956
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3900
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3188
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4352
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2836
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4976
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2856
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1692
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4180
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3268

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2976
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:536
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1272

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2088

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2060
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5100

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:404
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2836
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3748
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:404
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4776
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2060
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2880
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5112
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4484
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3168
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2976
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4684
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2836
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3828
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3236
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2912
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3316
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4828

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4408

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3368

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5060

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1308

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2384
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1692
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:624
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2564
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4828
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4828
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1316
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4808

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3520
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2908
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1620
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2272
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3612

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2080
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3160
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3940
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4040

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2480

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1508
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:676
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1868

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4432

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3236

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:372
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1040
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3404
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2648
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4092

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1684
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1508

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:232

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5060
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3192
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4900

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4612
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1004
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2824
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:876
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2880
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4184
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2352
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3204
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4252
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:3132
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4768
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4184
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3268
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3924
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1316
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3236

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4040

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2364
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4012
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1824
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1824
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4328
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4428
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:812
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2588

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4484

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2524

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3436
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3948
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4040
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3948
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2088
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2088
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3612

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2916

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:232

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3608
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3988
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4620
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2324
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2576
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3776
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4372
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2576
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4952
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2492
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4048
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:116
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4048
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1356
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1304

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3344
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1464

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4776
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3520

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4848

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1156
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4356

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2524
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:624
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:5068

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3404

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1256
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1868
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2580
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:456
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4668
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2828
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2884
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3784
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:4432
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        10⤵
        
        PID:3776
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:2932
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        11⤵
        
        PID:4320
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        12⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2084
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:3616
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2092
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3744
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:232

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4968
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1188
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4900

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4804

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:848
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3236
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:404
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4776
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4772
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2856
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4776
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:404
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4104
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:1308
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4104
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4672
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4104

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4672
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4628
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2272

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1312
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2356
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4668
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4884
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3608
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4884
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3784
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2576
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4964
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:5056
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1144

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4372

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4508

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:876

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3856

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3612
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1520
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1316
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4408

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4356
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3932
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:5116
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4104
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:2908
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1264
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3828
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:5100
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2384
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:3204
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:2352
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:1372
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:1524
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:2152

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5100
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2384
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1612
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4184
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3268
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4628
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        7⤵
        
        PID:4184
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        8⤵
        
        PID:4408
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:372
        
        C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        9⤵
        
        PID:3924

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4356
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2836

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3380

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4608

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3268

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4084

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3376
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3932

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2380
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4308
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3104

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2212
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:412
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1256
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2712
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4160
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2588
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1992

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2196
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4028
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:660
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1464
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4284
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4496
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:536

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4828
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4672
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4988

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2588
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2092

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3304
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:2380

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2824
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1824
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3740
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4576

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2836
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4104

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:624

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3616

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4608

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2824

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3616

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4428
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3856
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:676
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:3136
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4804
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:4572
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2524

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1952
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4012
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:2572
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2496
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:3304
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2472
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4952
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3104
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4036
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:788
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:1256

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1812
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4140
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4244

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4336
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:1764

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3168

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3104
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3432
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3532
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:3696
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4308

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3652

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3748
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4976

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:4168

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5056

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1256

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3748
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:4828

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:2340
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3748
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1308
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:2088
    - - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        5⤵
        
        PID:4808
      - C:\Windows\SysWOW64\setups.bak
        
        "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
        6⤵
        
        PID:2296

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3648

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:5116
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3132
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4664
  - - C:\Windows\SysWOW64\setups.bak
      "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
      4⤵
      PID:4060
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:4664

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:1316
- C:\Windows\SysWOW64\setups.bak
  "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
  2⤵
  PID:3612
- - C:\Windows\SysWOW64\setups.bak
    "C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
    3⤵
    PID:1468

C:\Windows\SysWOW64\setups.bak
"C:\Windows\system32\setups.bak" *C:\Windows\SysWOW64\setups.bak
1⤵
PID:3204

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\setups.bak

Filesize
42KB

MD5
98e56dfe05eee68843d93dc599fcb52a

SHA1
edfc5384dc09a46cc902fcf75b8c0f962ba5018f

SHA256
5deea66d5364878f8fb3ca146f4c0464c567102312b4eedaf59c0742331783f8

SHA512
6831c1dfa567b38a474c1735514056de84be633fb07c2fb9460504aa15f2471cfb755f16a1cf78627ba98fa568df90f77e225c9cf2c5e6424d140092fb13203f

Download Submit
C:\Windows\SysWOW64\setups.bak

Filesize
116KB

MD5
0929bb6a57c1c5c382b09d4275f5d00b

SHA1
04641e94a774af9274741672c5c01b2a620696e6

SHA256
7de0e07990cd241f8c9469b3daa6e666a1bc54cb9783ef5bd26f02c01b6316c3

SHA512
9d8897e7731822e6d876a4099dede4b6a1af0c24ef3b96be7dc3dd1e60dc883663b7f481a0296a56b8698948b1ef8c5e96fc2e439486cd8b5a5450de5b298043

Download Submit
C:\Windows\SysWOW64\setups.bak

Filesize
61KB

MD5
3b3282a8e2d56db008933db18d00383d

SHA1
d2df00b0dc839c05b316ec49c8ce51aead6be465

SHA256
5fe1fa1f14c9efd00e61eb63b26bc4938391fec3ad6db6ee78c461365b00f36e

SHA512
76fa77d28810645a21b50e4f8167100cb30ac37cb3dcc1cdc60703399823907d423b6f7e0b02bed75816e364b42c864252df304f218009fced8c767ca7840b11

Download Submit
C:\Windows\SysWOW64\setups.bak

Filesize
35KB

MD5
cc2535829e55f135611363f352397b59

SHA1
5ca021c7e1c9af09d82658940cc272eadac8a330

SHA256
23416e1083c6e19397e5971a715ee6a6c23950cedde198712fefd147196be481

SHA512
06d264a09d216ebd45057a10afd7a2e0fc27663c140f463181a22705ffadc7c23fcaabcee1df33392de5edbd6c9f99a877874467f85ad61ceb50eaba389e236e

Download Submit
C:\Windows\SysWOW64\setups.bak

Filesize
43KB

MD5
12a663bc8bda462855f7f2ee772f7569

SHA1
35a69dee4587938353106ecd6ecce123da5a6756

SHA256
bfb810788d25475dafb58a798543ce9db72ee58b42d4f4a25be401ef19b8de01

SHA512
6f1b7e3d50c84f589ff4c47d99fca124920983f6af4deef4693fb132bdfd6f4d653c4c83d1ce6b52c245ad47ebc00d61b650d00a268e007bf48ecb243f257042

Download Submit
C:\Windows\SysWOW64\setups.bak

Filesize
20KB

MD5
927e6076918d7c82b3d2a497497c5a0c

SHA1
52bb7c04142a89caa3798ea296424f7e4f6d82ad

SHA256
4ecbc089e6c82e7dc5c6d6b996f433069dcb9ca94ca5b26311f31947f58b09f0

SHA512
8ec4f71c52e7e08f37280e5bce6d7526d5d832622e2cd1f2405441a38edc34f08065b62b84cbd8e7c8ddb103c0d4b8102a53a19981c999542c81420522696825

Download Submit
C:\Windows\SysWOW64\setups.bak

Filesize
10KB

MD5
80b1f8da1464f13b4f5cdd2c3519b200

SHA1
96388b22dd99d970f66e9ec8d1289dc229d301d4

SHA256
bb377b68cab49a5db9cce650c487bf4d52244cc9263de13f4433f7ab67dd9eae

SHA512
5cc104b3ce36fe2a42d2e3852561c3b63ee51f1ef51104671b096c867653fedde7483971f66396639c066febb96b1d8c541e32f214e4dab1879c3f39726c4702

Download Submit
memory/532-127-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/536-49-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/772-81-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/788-89-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/968-7-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1040-59-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1256-12-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1276-54-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1280-99-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1312-105-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1356-42-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1392-72-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1828-5-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1952-94-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/1984-85-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2068-34-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2184-30-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2352-37-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2364-108-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2388-61-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2464-3-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2472-90-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2564-101-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2784-124-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2844-121-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3148-79-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3292-118-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3304-110-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3344-22-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3400-33-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3432-21-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3440-76-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3600-86-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3608-10-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3660-31-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3664-116-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3832-113-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3928-66-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3932-65-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/3988-8-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4028-62-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4032-75-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4036-107-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4092-16-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4180-103-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4336-39-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4352-97-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4420-45-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4428-115-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4520-56-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4552-41-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4628-93-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4656-25-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4752-70-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4804-68-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4844-26-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4848-14-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4864-83-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4896-50-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4900-52-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4904-123-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/4968-46-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/5096-18-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/5096-128-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads