Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 21:34 UTC

General

  • Target

    2c7a587790b7d87c6b4f46f320fd9acfd94e4126a4530be157f04c66073ea169.exe

  • Size

    72KB

  • MD5

    04ae2d1a8e96da8a301d5d92f64b09c3

  • SHA1

    583135516b3a2773d47796342af041851f990032

  • SHA256

    2c7a587790b7d87c6b4f46f320fd9acfd94e4126a4530be157f04c66073ea169

  • SHA512

    8804af783bc58b798e7b2fa98439a165281e7d674485bc8e5a11c3c0d4fb1967fec0e65d5249bf143e879100ec4021dfcbef3a4a2ccac952c141eb7cf03d923d

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2O:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP6

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2c7a587790b7d87c6b4f46f320fd9acfd94e4126a4530be157f04c66073ea169.exe
    "C:\Users\Admin\AppData\Local\Temp\2c7a587790b7d87c6b4f46f320fd9acfd94e4126a4530be157f04c66073ea169.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\1274128366\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1274128366\backup.exe C:\Users\Admin\AppData\Local\Temp\1274128366\
      2⤵
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1472
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1572
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:580
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1532
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:908
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1484
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1604
            • C:\Program Files\Common Files\Microsoft Shared\update.exe
              "C:\Program Files\Common Files\Microsoft Shared\update.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              PID:1072
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1540
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • System policy modification
                PID:1120
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:1712
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:696
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Suspicious use of SetWindowsHookEx
                  PID:1144
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Suspicious use of SetWindowsHookEx
                  PID:1940
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:1112
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:1620
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:1752
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:1188
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Suspicious use of SetWindowsHookEx
                  PID:1724
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:468
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:1184
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:776
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:272
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:1704
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:1512
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:576
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1924
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1160
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1128
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1108
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1600
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Suspicious use of SetWindowsHookEx
                  PID:1180
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Suspicious use of SetWindowsHookEx
                  PID:1976
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:1692
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                    PID:1144
                  • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                    8⤵
                      PID:1216
                    • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                      8⤵
                        PID:1532
                      • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                        8⤵
                          PID:1452
                        • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                          8⤵
                            PID:1612
                          • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                            8⤵
                              PID:1168
                            • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                              8⤵
                                PID:1324
                              • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                                8⤵
                                  PID:1660
                                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                                  8⤵
                                    PID:1924
                                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1736
                                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\data.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    PID:624
                                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    PID:1612
                                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                                    8⤵
                                    • Executes dropped EXE
                                    PID:952
                                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                                    8⤵
                                      PID:1704
                                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                                      8⤵
                                        PID:1988
                                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                                        8⤵
                                          PID:972
                                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                        7⤵
                                          PID:1816
                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                          7⤵
                                            PID:1160
                                          • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                            7⤵
                                              PID:1620
                                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                              7⤵
                                                PID:764
                                              • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                                "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                                7⤵
                                                  PID:1212
                                                • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                                  "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                                  7⤵
                                                    PID:1580
                                                  • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                                    "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                                    7⤵
                                                      PID:1844
                                                  • C:\Program Files\Common Files\Services\backup.exe
                                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1772
                                                  • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                                    "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:932
                                                    • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                                      "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      PID:1608
                                                  • C:\Program Files\Common Files\System\backup.exe
                                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • System policy modification
                                                    PID:1112
                                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                      7⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • System policy modification
                                                      PID:1460
                                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                        8⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • System policy modification
                                                        PID:452
                                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                        8⤵
                                                          PID:800
                                                        • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                          8⤵
                                                            PID:1700
                                                          • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                            "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                            8⤵
                                                              PID:468
                                                            • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                              "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                              8⤵
                                                                PID:1608
                                                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                8⤵
                                                                  PID:272
                                                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                7⤵
                                                                • System policy modification
                                                                PID:1724
                                                              • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                7⤵
                                                                  PID:1784
                                                                • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                  7⤵
                                                                    PID:1172
                                                                  • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                    7⤵
                                                                      PID:1476
                                                                    • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                      7⤵
                                                                        PID:924
                                                                      • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                        "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                        7⤵
                                                                          PID:1716
                                                                        • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                          "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                          7⤵
                                                                            PID:1960
                                                                      • C:\Program Files\DVD Maker\backup.exe
                                                                        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1536
                                                                        • C:\Program Files\DVD Maker\de-DE\System Restore.exe
                                                                          "C:\Program Files\DVD Maker\de-DE\System Restore.exe" C:\Program Files\DVD Maker\de-DE\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1612
                                                                        • C:\Program Files\DVD Maker\en-US\backup.exe
                                                                          "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1796
                                                                        • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                          "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:972
                                                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1708
                                                                        • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                          "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                          6⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:576
                                                                        • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                          "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • System policy modification
                                                                          PID:800
                                                                        • C:\Program Files\DVD Maker\Shared\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                                          6⤵
                                                                          • Executes dropped EXE
                                                                          PID:1488
                                                                      • C:\Program Files\Google\backup.exe
                                                                        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                        5⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • Drops file in Program Files directory
                                                                        • System policy modification
                                                                        PID:1084
                                                                        • C:\Program Files\Google\Chrome\backup.exe
                                                                          "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                          6⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Program Files directory
                                                                          • System policy modification
                                                                          PID:1224
                                                                          • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                            7⤵
                                                                              PID:980
                                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                          5⤵
                                                                            PID:1640
                                                                          • C:\Program Files\Java\backup.exe
                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                            5⤵
                                                                              PID:1940
                                                                            • C:\Program Files\Microsoft Games\backup.exe
                                                                              "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                              5⤵
                                                                                PID:1364
                                                                              • C:\Program Files\Microsoft Office\backup.exe
                                                                                "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                5⤵
                                                                                  PID:932
                                                                                • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                  "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                  5⤵
                                                                                    PID:1544
                                                                                  • C:\Program Files\MSBuild\backup.exe
                                                                                    "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                    5⤵
                                                                                      PID:1772
                                                                                    • C:\Program Files\Reference Assemblies\backup.exe
                                                                                      "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                                      5⤵
                                                                                        PID:1872
                                                                                    • C:\Program Files (x86)\backup.exe
                                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                      4⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Executes dropped EXE
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Program Files directory
                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                      • System policy modification
                                                                                      PID:1672
                                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                        5⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:1008
                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                          6⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1552
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                            7⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:1624
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                            7⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:364
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                              8⤵
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:1628
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:1812
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                              8⤵
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:1488
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Program Files directory
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:1088
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                9⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1144
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:952
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:652
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                9⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1876
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                              8⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:1516
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                              8⤵
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Program Files directory
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1768
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
                                                                                                9⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • System policy modification
                                                                                                PID:864
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
                                                                                                  10⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • System policy modification
                                                                                                  PID:1628
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
                                                                                                9⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • System policy modification
                                                                                                PID:1564
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
                                                                                                  10⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • System policy modification
                                                                                                  PID:764
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                    11⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Executes dropped EXE
                                                                                                    • System policy modification
                                                                                                    PID:992
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
                                                                                                9⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • System policy modification
                                                                                                PID:1188
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
                                                                                                  10⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • System policy modification
                                                                                                  PID:1320
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
                                                                                                9⤵
                                                                                                  PID:604
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Drops file in Program Files directory
                                                                                                PID:776
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
                                                                                                  9⤵
                                                                                                    PID:1144
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                  8⤵
                                                                                                    PID:1996
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                    8⤵
                                                                                                      PID:888
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                    7⤵
                                                                                                      PID:1668
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                      7⤵
                                                                                                        PID:828
                                                                                                  • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                    5⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Drops file in Program Files directory
                                                                                                    • System policy modification
                                                                                                    PID:1720
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                      6⤵
                                                                                                        PID:1180
                                                                                                      • C:\Program Files (x86)\Common Files\Adobe AIR\update.exe
                                                                                                        "C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                        6⤵
                                                                                                          PID:1352
                                                                                                        • C:\Program Files (x86)\Common Files\DESIGNER\update.exe
                                                                                                          "C:\Program Files (x86)\Common Files\DESIGNER\update.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                          6⤵
                                                                                                            PID:1068
                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\update.exe
                                                                                                            "C:\Program Files (x86)\Common Files\microsoft shared\update.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                            6⤵
                                                                                                              PID:1468
                                                                                                          • C:\Program Files (x86)\Google\update.exe
                                                                                                            "C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\
                                                                                                            5⤵
                                                                                                              PID:1512
                                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                              5⤵
                                                                                                                PID:1392
                                                                                                              • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                5⤵
                                                                                                                  PID:380
                                                                                                                • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                  5⤵
                                                                                                                    PID:1308
                                                                                                                  • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                    5⤵
                                                                                                                      PID:1648
                                                                                                                    • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                      5⤵
                                                                                                                        PID:1676
                                                                                                                      • C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
                                                                                                                        5⤵
                                                                                                                          PID:1692
                                                                                                                      • C:\Users\backup.exe
                                                                                                                        C:\Users\backup.exe C:\Users\
                                                                                                                        4⤵
                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                        • System policy modification
                                                                                                                        PID:1964
                                                                                                                        • C:\Users\Admin\backup.exe
                                                                                                                          C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                          5⤵
                                                                                                                            PID:692
                                                                                                                          • C:\Users\Public\backup.exe
                                                                                                                            C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                            5⤵
                                                                                                                              PID:240
                                                                                                                          • C:\Windows\backup.exe
                                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                                            4⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            • Drops file in Windows directory
                                                                                                                            PID:1284
                                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                              5⤵
                                                                                                                                PID:956
                                                                                                                              • C:\Windows\AppCompat\backup.exe
                                                                                                                                C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                5⤵
                                                                                                                                  PID:1540
                                                                                                                                • C:\Windows\AppPatch\backup.exe
                                                                                                                                  C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                  5⤵
                                                                                                                                    PID:532
                                                                                                                                  • C:\Windows\assembly\backup.exe
                                                                                                                                    C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                    5⤵
                                                                                                                                      PID:568
                                                                                                                                    • C:\Windows\Branding\backup.exe
                                                                                                                                      C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                                                      5⤵
                                                                                                                                        PID:1164
                                                                                                                                      • C:\Windows\CSC\backup.exe
                                                                                                                                        C:\Windows\CSC\backup.exe C:\Windows\CSC\
                                                                                                                                        5⤵
                                                                                                                                          PID:1712
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • System policy modification
                                                                                                                                    PID:760
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1804
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • System policy modification
                                                                                                                                    PID:1724
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1964
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1208
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Loads dropped DLL
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • System policy modification
                                                                                                                                    PID:1924

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\PerfLogs\Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  e1bc41c9b52876365281ba89b9959d4d

                                                                                                                                  SHA1

                                                                                                                                  2e958dfa25774bff425200b507f4f88c63a69927

                                                                                                                                  SHA256

                                                                                                                                  3b69568bf30c8f7064912b11f281bc6389194361815329c9b5f19a6bf9e3457c

                                                                                                                                  SHA512

                                                                                                                                  2d8c58fb65c29fccd0ebdfa301f6cd34df184bd8c957b4806eff4f9908bef1758feb6a4316bab77d7eea0c21ccd461eab90ad96990c24312477c9fc66bc68224

                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d3774be7285a6e027b38d2b744f8b458

                                                                                                                                  SHA1

                                                                                                                                  907d1ef118019fb6a5acdf772a5d7bb7863333ad

                                                                                                                                  SHA256

                                                                                                                                  5670e788428bbed9f449d577eb1acbe1c5890293611e7ea5e949fccbb8ffc21b

                                                                                                                                  SHA512

                                                                                                                                  6472c828073e33cfab9a631fa4a909db685d19c5b43950e5691e8c3f9a090a326f406c3a0b3735e8f674471a15c9c1eba51d959cd6bfd50846ee4334cd3c8e18

                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d3774be7285a6e027b38d2b744f8b458

                                                                                                                                  SHA1

                                                                                                                                  907d1ef118019fb6a5acdf772a5d7bb7863333ad

                                                                                                                                  SHA256

                                                                                                                                  5670e788428bbed9f449d577eb1acbe1c5890293611e7ea5e949fccbb8ffc21b

                                                                                                                                  SHA512

                                                                                                                                  6472c828073e33cfab9a631fa4a909db685d19c5b43950e5691e8c3f9a090a326f406c3a0b3735e8f674471a15c9c1eba51d959cd6bfd50846ee4334cd3c8e18

                                                                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b37af9cb493f2b72be89242d4f9c4a30

                                                                                                                                  SHA1

                                                                                                                                  d30929582f488d120b2ce375367225ca12954c14

                                                                                                                                  SHA256

                                                                                                                                  3b50beb3a475b99264a39d32044e50ee80af79db4fa74093a56a00957ab4c782

                                                                                                                                  SHA512

                                                                                                                                  8a4cfbea9e59fdaa3641525d9459679c06fcfe9d44f2c1f4d3b4cc24ab7e949ab665e655eabda26a58a9c5c516123b08d742e6e1ae257f6cbe65016b73008f90

                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  84a9fec14de0fb4d377bea5d0b37f11f

                                                                                                                                  SHA1

                                                                                                                                  75df72db8d93effd0249438c6844692682a3c4da

                                                                                                                                  SHA256

                                                                                                                                  5f315fa325a60e1fbd1129e9f78f61c11fe38b3363350dcc449a4d6f617311c9

                                                                                                                                  SHA512

                                                                                                                                  81d753405eb052ac1d9dc821ccb81fbabb3f72369c702033582c581d84b82a1f454e90f42310f98f6c1be2706afc16f0add1cab2e7cb91f18528919e2afc9661

                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  84a9fec14de0fb4d377bea5d0b37f11f

                                                                                                                                  SHA1

                                                                                                                                  75df72db8d93effd0249438c6844692682a3c4da

                                                                                                                                  SHA256

                                                                                                                                  5f315fa325a60e1fbd1129e9f78f61c11fe38b3363350dcc449a4d6f617311c9

                                                                                                                                  SHA512

                                                                                                                                  81d753405eb052ac1d9dc821ccb81fbabb3f72369c702033582c581d84b82a1f454e90f42310f98f6c1be2706afc16f0add1cab2e7cb91f18528919e2afc9661

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  2cfe5af4f06d9d5e2cf72c84aeba0e31

                                                                                                                                  SHA1

                                                                                                                                  d5107c34296a255b76230a5319d315f410e89867

                                                                                                                                  SHA256

                                                                                                                                  892b94d9d15c7c91b4a48366ccc20a9169cbc202a9273a6bce69a8b774c22ba1

                                                                                                                                  SHA512

                                                                                                                                  266961cc7e12c198b7ec85b112b2832d182ef1d4caf22d851ce87a29ed2935435394e2e5b2a1bffe3faad755ca351f74908579047972e487de0c2d9bf29e4d3e

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  2cfe5af4f06d9d5e2cf72c84aeba0e31

                                                                                                                                  SHA1

                                                                                                                                  d5107c34296a255b76230a5319d315f410e89867

                                                                                                                                  SHA256

                                                                                                                                  892b94d9d15c7c91b4a48366ccc20a9169cbc202a9273a6bce69a8b774c22ba1

                                                                                                                                  SHA512

                                                                                                                                  266961cc7e12c198b7ec85b112b2832d182ef1d4caf22d851ce87a29ed2935435394e2e5b2a1bffe3faad755ca351f74908579047972e487de0c2d9bf29e4d3e

                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  7ee815d85912396c1e963ce4acf1664e

                                                                                                                                  SHA1

                                                                                                                                  30ba2e097b875c62bc7f5e878d5020b4bd5f91ff

                                                                                                                                  SHA256

                                                                                                                                  a7613e8947c40f338ee512742ba000655d7750e67c061ffdcbcabb59c97e0128

                                                                                                                                  SHA512

                                                                                                                                  5aa0afe92a88ccb4cb11078ad865c336363ebe2b7224356789f4b069927af7382a3c062d358b521ceb6d591c21c70bf66c57ac30b6d6757270d27da6450f6bc6

                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  7ee815d85912396c1e963ce4acf1664e

                                                                                                                                  SHA1

                                                                                                                                  30ba2e097b875c62bc7f5e878d5020b4bd5f91ff

                                                                                                                                  SHA256

                                                                                                                                  a7613e8947c40f338ee512742ba000655d7750e67c061ffdcbcabb59c97e0128

                                                                                                                                  SHA512

                                                                                                                                  5aa0afe92a88ccb4cb11078ad865c336363ebe2b7224356789f4b069927af7382a3c062d358b521ceb6d591c21c70bf66c57ac30b6d6757270d27da6450f6bc6

                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  42930d81cd497388935fe6ba00dd6d8e

                                                                                                                                  SHA1

                                                                                                                                  cf8128727d8034ae616af2f95bcdf75f81be96f2

                                                                                                                                  SHA256

                                                                                                                                  a61d24109bb46f4eda2860310cf746b201b00c0efc31ed5410e4079df42b9b05

                                                                                                                                  SHA512

                                                                                                                                  cf851825cd7275cb58a7f3e0176204318c346e988011ac2bc48cf8ee8fe783a4b5618588277e34b90711891fb0520b1bb8d169e2d43c087158ed07bd550c6c67

                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  42930d81cd497388935fe6ba00dd6d8e

                                                                                                                                  SHA1

                                                                                                                                  cf8128727d8034ae616af2f95bcdf75f81be96f2

                                                                                                                                  SHA256

                                                                                                                                  a61d24109bb46f4eda2860310cf746b201b00c0efc31ed5410e4079df42b9b05

                                                                                                                                  SHA512

                                                                                                                                  cf851825cd7275cb58a7f3e0176204318c346e988011ac2bc48cf8ee8fe783a4b5618588277e34b90711891fb0520b1bb8d169e2d43c087158ed07bd550c6c67

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1274128366\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\1274128366\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  00e27ff1e9ccdd6f948bd60804662ea9

                                                                                                                                  SHA1

                                                                                                                                  d1ce550c820a8df9e71af56195aac1323b9ee6ed

                                                                                                                                  SHA256

                                                                                                                                  fb2e34c786964cba8e3aa50a07b973dba832fed36b15a424fdfd94576cca0e94

                                                                                                                                  SHA512

                                                                                                                                  759f13677da52e510485e1a49fc9b85ba14764f93686987d90db5893078969f652edea7daf414993c0d743d4cc0cca5df2c360b21758d59ef15a35d3a2c405aa

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  00e27ff1e9ccdd6f948bd60804662ea9

                                                                                                                                  SHA1

                                                                                                                                  d1ce550c820a8df9e71af56195aac1323b9ee6ed

                                                                                                                                  SHA256

                                                                                                                                  fb2e34c786964cba8e3aa50a07b973dba832fed36b15a424fdfd94576cca0e94

                                                                                                                                  SHA512

                                                                                                                                  759f13677da52e510485e1a49fc9b85ba14764f93686987d90db5893078969f652edea7daf414993c0d743d4cc0cca5df2c360b21758d59ef15a35d3a2c405aa

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  63560bd1258006cc0321650d9a749e7a

                                                                                                                                  SHA1

                                                                                                                                  0faa4d2b42b1c4a08129438adc380b91ee0b1061

                                                                                                                                  SHA256

                                                                                                                                  514f59ddf399ebe031e256905374eedd86fe27ea835593f73195b01f3d1fb896

                                                                                                                                  SHA512

                                                                                                                                  d14c94b4c0af7a5fd748ccfb063425e3d94336ef959ee6777f939d15b57a7ee5f4939de1a316fc9972708f730f0fb285fb8be450141fc6ea0c15868e14c07313

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  af99113584340ff00f61cb9a4d294634

                                                                                                                                  SHA1

                                                                                                                                  906679c6925c796159b74c5d80dd067a492c260a

                                                                                                                                  SHA256

                                                                                                                                  05608fdfd525a16b2438e8d8b7121a21b5ef141f9810c6317184c0ba70e824dd

                                                                                                                                  SHA512

                                                                                                                                  4876c36e31c4eb5755f44a7bb2d20798f64d0a00ab98d265db33001a30026541b7f5a7b82d3c3302f7ea85d138141093958631391ea9828a1a8fd7571ea070ff

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  af99113584340ff00f61cb9a4d294634

                                                                                                                                  SHA1

                                                                                                                                  906679c6925c796159b74c5d80dd067a492c260a

                                                                                                                                  SHA256

                                                                                                                                  05608fdfd525a16b2438e8d8b7121a21b5ef141f9810c6317184c0ba70e824dd

                                                                                                                                  SHA512

                                                                                                                                  4876c36e31c4eb5755f44a7bb2d20798f64d0a00ab98d265db33001a30026541b7f5a7b82d3c3302f7ea85d138141093958631391ea9828a1a8fd7571ea070ff

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a66db196d9570bb99ad375ce674a6b54

                                                                                                                                  SHA1

                                                                                                                                  4bbcad02c1558987640f1d7c5f576cde98dd856f

                                                                                                                                  SHA256

                                                                                                                                  6e01707fd7a517d59504f9bae099ffff3e39677103ece2b360ca43e01b67f5c1

                                                                                                                                  SHA512

                                                                                                                                  6d20ccda7285a30dd2586dc921340a845c98e9452396e2e32467c7a1bbb25e28c36d43aa2bfb0276259743105b7a9cfba0b704c04a6efda3cb601f5307d2c18c

                                                                                                                                • C:\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  4e8328bffcbd57cddf1981c45d9acafe

                                                                                                                                  SHA1

                                                                                                                                  3c56d4581e49b6b95578cff5915faed4067a92f5

                                                                                                                                  SHA256

                                                                                                                                  9e0c9aed9fdf30fc8327b2d9462b23722fafbc8e5f4d1c9b7bd7b765c5b28b0c

                                                                                                                                  SHA512

                                                                                                                                  52b45c897456d32408424811fc27606a1b883df24906f1318e2ccc8bf30735da63ef1174745cc6f20a83480887ad5ba2e66bb787f989286f70ac981d7b9bc7b8

                                                                                                                                • C:\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  4e8328bffcbd57cddf1981c45d9acafe

                                                                                                                                  SHA1

                                                                                                                                  3c56d4581e49b6b95578cff5915faed4067a92f5

                                                                                                                                  SHA256

                                                                                                                                  9e0c9aed9fdf30fc8327b2d9462b23722fafbc8e5f4d1c9b7bd7b765c5b28b0c

                                                                                                                                  SHA512

                                                                                                                                  52b45c897456d32408424811fc27606a1b883df24906f1318e2ccc8bf30735da63ef1174745cc6f20a83480887ad5ba2e66bb787f989286f70ac981d7b9bc7b8

                                                                                                                                • \PerfLogs\Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  e1bc41c9b52876365281ba89b9959d4d

                                                                                                                                  SHA1

                                                                                                                                  2e958dfa25774bff425200b507f4f88c63a69927

                                                                                                                                  SHA256

                                                                                                                                  3b69568bf30c8f7064912b11f281bc6389194361815329c9b5f19a6bf9e3457c

                                                                                                                                  SHA512

                                                                                                                                  2d8c58fb65c29fccd0ebdfa301f6cd34df184bd8c957b4806eff4f9908bef1758feb6a4316bab77d7eea0c21ccd461eab90ad96990c24312477c9fc66bc68224

                                                                                                                                • \PerfLogs\Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  e1bc41c9b52876365281ba89b9959d4d

                                                                                                                                  SHA1

                                                                                                                                  2e958dfa25774bff425200b507f4f88c63a69927

                                                                                                                                  SHA256

                                                                                                                                  3b69568bf30c8f7064912b11f281bc6389194361815329c9b5f19a6bf9e3457c

                                                                                                                                  SHA512

                                                                                                                                  2d8c58fb65c29fccd0ebdfa301f6cd34df184bd8c957b4806eff4f9908bef1758feb6a4316bab77d7eea0c21ccd461eab90ad96990c24312477c9fc66bc68224

                                                                                                                                • \PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d3774be7285a6e027b38d2b744f8b458

                                                                                                                                  SHA1

                                                                                                                                  907d1ef118019fb6a5acdf772a5d7bb7863333ad

                                                                                                                                  SHA256

                                                                                                                                  5670e788428bbed9f449d577eb1acbe1c5890293611e7ea5e949fccbb8ffc21b

                                                                                                                                  SHA512

                                                                                                                                  6472c828073e33cfab9a631fa4a909db685d19c5b43950e5691e8c3f9a090a326f406c3a0b3735e8f674471a15c9c1eba51d959cd6bfd50846ee4334cd3c8e18

                                                                                                                                • \PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d3774be7285a6e027b38d2b744f8b458

                                                                                                                                  SHA1

                                                                                                                                  907d1ef118019fb6a5acdf772a5d7bb7863333ad

                                                                                                                                  SHA256

                                                                                                                                  5670e788428bbed9f449d577eb1acbe1c5890293611e7ea5e949fccbb8ffc21b

                                                                                                                                  SHA512

                                                                                                                                  6472c828073e33cfab9a631fa4a909db685d19c5b43950e5691e8c3f9a090a326f406c3a0b3735e8f674471a15c9c1eba51d959cd6bfd50846ee4334cd3c8e18

                                                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b37af9cb493f2b72be89242d4f9c4a30

                                                                                                                                  SHA1

                                                                                                                                  d30929582f488d120b2ce375367225ca12954c14

                                                                                                                                  SHA256

                                                                                                                                  3b50beb3a475b99264a39d32044e50ee80af79db4fa74093a56a00957ab4c782

                                                                                                                                  SHA512

                                                                                                                                  8a4cfbea9e59fdaa3641525d9459679c06fcfe9d44f2c1f4d3b4cc24ab7e949ab665e655eabda26a58a9c5c516123b08d742e6e1ae257f6cbe65016b73008f90

                                                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b37af9cb493f2b72be89242d4f9c4a30

                                                                                                                                  SHA1

                                                                                                                                  d30929582f488d120b2ce375367225ca12954c14

                                                                                                                                  SHA256

                                                                                                                                  3b50beb3a475b99264a39d32044e50ee80af79db4fa74093a56a00957ab4c782

                                                                                                                                  SHA512

                                                                                                                                  8a4cfbea9e59fdaa3641525d9459679c06fcfe9d44f2c1f4d3b4cc24ab7e949ab665e655eabda26a58a9c5c516123b08d742e6e1ae257f6cbe65016b73008f90

                                                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  84a9fec14de0fb4d377bea5d0b37f11f

                                                                                                                                  SHA1

                                                                                                                                  75df72db8d93effd0249438c6844692682a3c4da

                                                                                                                                  SHA256

                                                                                                                                  5f315fa325a60e1fbd1129e9f78f61c11fe38b3363350dcc449a4d6f617311c9

                                                                                                                                  SHA512

                                                                                                                                  81d753405eb052ac1d9dc821ccb81fbabb3f72369c702033582c581d84b82a1f454e90f42310f98f6c1be2706afc16f0add1cab2e7cb91f18528919e2afc9661

                                                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  84a9fec14de0fb4d377bea5d0b37f11f

                                                                                                                                  SHA1

                                                                                                                                  75df72db8d93effd0249438c6844692682a3c4da

                                                                                                                                  SHA256

                                                                                                                                  5f315fa325a60e1fbd1129e9f78f61c11fe38b3363350dcc449a4d6f617311c9

                                                                                                                                  SHA512

                                                                                                                                  81d753405eb052ac1d9dc821ccb81fbabb3f72369c702033582c581d84b82a1f454e90f42310f98f6c1be2706afc16f0add1cab2e7cb91f18528919e2afc9661

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  3fbacc30e02757c3ab4dd06e8c117663

                                                                                                                                  SHA1

                                                                                                                                  ad7cc01f1e5eee3c1a3c144bd43df132ba3ab8a7

                                                                                                                                  SHA256

                                                                                                                                  130407b916d606141609b58fe3fa14b97879aaa9db2210b582772d8e503fd381

                                                                                                                                  SHA512

                                                                                                                                  e4e405332e46f5ed7ac037efb76a95cfdd51367731371bac76ee6cf157fe958aafa69efcff12704463fdd4355b03012b066aa9f109700e7fc925ccf10806464c

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  dc38bb17c295df22eb3b6d54844a5d7f

                                                                                                                                  SHA1

                                                                                                                                  d898864e1477b811301f9ede09466ac07520a018

                                                                                                                                  SHA256

                                                                                                                                  dd3ffc9d34efbb1513077421e7befa201c248fcc5bb5b8b605fab9c8d594ab20

                                                                                                                                  SHA512

                                                                                                                                  5b3b8b751ff0eaeb6f55d6df0f3923194685042900820c5b2b61a03bf67ba217ca4b32f55c2cfd142949ff243284743b8e446cfafedd0c798784458601cd81ed

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  dc38bb17c295df22eb3b6d54844a5d7f

                                                                                                                                  SHA1

                                                                                                                                  d898864e1477b811301f9ede09466ac07520a018

                                                                                                                                  SHA256

                                                                                                                                  dd3ffc9d34efbb1513077421e7befa201c248fcc5bb5b8b605fab9c8d594ab20

                                                                                                                                  SHA512

                                                                                                                                  5b3b8b751ff0eaeb6f55d6df0f3923194685042900820c5b2b61a03bf67ba217ca4b32f55c2cfd142949ff243284743b8e446cfafedd0c798784458601cd81ed

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  2cfe5af4f06d9d5e2cf72c84aeba0e31

                                                                                                                                  SHA1

                                                                                                                                  d5107c34296a255b76230a5319d315f410e89867

                                                                                                                                  SHA256

                                                                                                                                  892b94d9d15c7c91b4a48366ccc20a9169cbc202a9273a6bce69a8b774c22ba1

                                                                                                                                  SHA512

                                                                                                                                  266961cc7e12c198b7ec85b112b2832d182ef1d4caf22d851ce87a29ed2935435394e2e5b2a1bffe3faad755ca351f74908579047972e487de0c2d9bf29e4d3e

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  2cfe5af4f06d9d5e2cf72c84aeba0e31

                                                                                                                                  SHA1

                                                                                                                                  d5107c34296a255b76230a5319d315f410e89867

                                                                                                                                  SHA256

                                                                                                                                  892b94d9d15c7c91b4a48366ccc20a9169cbc202a9273a6bce69a8b774c22ba1

                                                                                                                                  SHA512

                                                                                                                                  266961cc7e12c198b7ec85b112b2832d182ef1d4caf22d851ce87a29ed2935435394e2e5b2a1bffe3faad755ca351f74908579047972e487de0c2d9bf29e4d3e

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  2cfe5af4f06d9d5e2cf72c84aeba0e31

                                                                                                                                  SHA1

                                                                                                                                  d5107c34296a255b76230a5319d315f410e89867

                                                                                                                                  SHA256

                                                                                                                                  892b94d9d15c7c91b4a48366ccc20a9169cbc202a9273a6bce69a8b774c22ba1

                                                                                                                                  SHA512

                                                                                                                                  266961cc7e12c198b7ec85b112b2832d182ef1d4caf22d851ce87a29ed2935435394e2e5b2a1bffe3faad755ca351f74908579047972e487de0c2d9bf29e4d3e

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  2cfe5af4f06d9d5e2cf72c84aeba0e31

                                                                                                                                  SHA1

                                                                                                                                  d5107c34296a255b76230a5319d315f410e89867

                                                                                                                                  SHA256

                                                                                                                                  892b94d9d15c7c91b4a48366ccc20a9169cbc202a9273a6bce69a8b774c22ba1

                                                                                                                                  SHA512

                                                                                                                                  266961cc7e12c198b7ec85b112b2832d182ef1d4caf22d851ce87a29ed2935435394e2e5b2a1bffe3faad755ca351f74908579047972e487de0c2d9bf29e4d3e

                                                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  7ee815d85912396c1e963ce4acf1664e

                                                                                                                                  SHA1

                                                                                                                                  30ba2e097b875c62bc7f5e878d5020b4bd5f91ff

                                                                                                                                  SHA256

                                                                                                                                  a7613e8947c40f338ee512742ba000655d7750e67c061ffdcbcabb59c97e0128

                                                                                                                                  SHA512

                                                                                                                                  5aa0afe92a88ccb4cb11078ad865c336363ebe2b7224356789f4b069927af7382a3c062d358b521ceb6d591c21c70bf66c57ac30b6d6757270d27da6450f6bc6

                                                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  7ee815d85912396c1e963ce4acf1664e

                                                                                                                                  SHA1

                                                                                                                                  30ba2e097b875c62bc7f5e878d5020b4bd5f91ff

                                                                                                                                  SHA256

                                                                                                                                  a7613e8947c40f338ee512742ba000655d7750e67c061ffdcbcabb59c97e0128

                                                                                                                                  SHA512

                                                                                                                                  5aa0afe92a88ccb4cb11078ad865c336363ebe2b7224356789f4b069927af7382a3c062d358b521ceb6d591c21c70bf66c57ac30b6d6757270d27da6450f6bc6

                                                                                                                                • \Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  42930d81cd497388935fe6ba00dd6d8e

                                                                                                                                  SHA1

                                                                                                                                  cf8128727d8034ae616af2f95bcdf75f81be96f2

                                                                                                                                  SHA256

                                                                                                                                  a61d24109bb46f4eda2860310cf746b201b00c0efc31ed5410e4079df42b9b05

                                                                                                                                  SHA512

                                                                                                                                  cf851825cd7275cb58a7f3e0176204318c346e988011ac2bc48cf8ee8fe783a4b5618588277e34b90711891fb0520b1bb8d169e2d43c087158ed07bd550c6c67

                                                                                                                                • \Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  42930d81cd497388935fe6ba00dd6d8e

                                                                                                                                  SHA1

                                                                                                                                  cf8128727d8034ae616af2f95bcdf75f81be96f2

                                                                                                                                  SHA256

                                                                                                                                  a61d24109bb46f4eda2860310cf746b201b00c0efc31ed5410e4079df42b9b05

                                                                                                                                  SHA512

                                                                                                                                  cf851825cd7275cb58a7f3e0176204318c346e988011ac2bc48cf8ee8fe783a4b5618588277e34b90711891fb0520b1bb8d169e2d43c087158ed07bd550c6c67

                                                                                                                                • \Users\Admin\AppData\Local\Temp\1274128366\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • \Users\Admin\AppData\Local\Temp\1274128366\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  00e27ff1e9ccdd6f948bd60804662ea9

                                                                                                                                  SHA1

                                                                                                                                  d1ce550c820a8df9e71af56195aac1323b9ee6ed

                                                                                                                                  SHA256

                                                                                                                                  fb2e34c786964cba8e3aa50a07b973dba832fed36b15a424fdfd94576cca0e94

                                                                                                                                  SHA512

                                                                                                                                  759f13677da52e510485e1a49fc9b85ba14764f93686987d90db5893078969f652edea7daf414993c0d743d4cc0cca5df2c360b21758d59ef15a35d3a2c405aa

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  00e27ff1e9ccdd6f948bd60804662ea9

                                                                                                                                  SHA1

                                                                                                                                  d1ce550c820a8df9e71af56195aac1323b9ee6ed

                                                                                                                                  SHA256

                                                                                                                                  fb2e34c786964cba8e3aa50a07b973dba832fed36b15a424fdfd94576cca0e94

                                                                                                                                  SHA512

                                                                                                                                  759f13677da52e510485e1a49fc9b85ba14764f93686987d90db5893078969f652edea7daf414993c0d743d4cc0cca5df2c360b21758d59ef15a35d3a2c405aa

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  00e27ff1e9ccdd6f948bd60804662ea9

                                                                                                                                  SHA1

                                                                                                                                  d1ce550c820a8df9e71af56195aac1323b9ee6ed

                                                                                                                                  SHA256

                                                                                                                                  fb2e34c786964cba8e3aa50a07b973dba832fed36b15a424fdfd94576cca0e94

                                                                                                                                  SHA512

                                                                                                                                  759f13677da52e510485e1a49fc9b85ba14764f93686987d90db5893078969f652edea7daf414993c0d743d4cc0cca5df2c360b21758d59ef15a35d3a2c405aa

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  00e27ff1e9ccdd6f948bd60804662ea9

                                                                                                                                  SHA1

                                                                                                                                  d1ce550c820a8df9e71af56195aac1323b9ee6ed

                                                                                                                                  SHA256

                                                                                                                                  fb2e34c786964cba8e3aa50a07b973dba832fed36b15a424fdfd94576cca0e94

                                                                                                                                  SHA512

                                                                                                                                  759f13677da52e510485e1a49fc9b85ba14764f93686987d90db5893078969f652edea7daf414993c0d743d4cc0cca5df2c360b21758d59ef15a35d3a2c405aa

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  63560bd1258006cc0321650d9a749e7a

                                                                                                                                  SHA1

                                                                                                                                  0faa4d2b42b1c4a08129438adc380b91ee0b1061

                                                                                                                                  SHA256

                                                                                                                                  514f59ddf399ebe031e256905374eedd86fe27ea835593f73195b01f3d1fb896

                                                                                                                                  SHA512

                                                                                                                                  d14c94b4c0af7a5fd748ccfb063425e3d94336ef959ee6777f939d15b57a7ee5f4939de1a316fc9972708f730f0fb285fb8be450141fc6ea0c15868e14c07313

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  63560bd1258006cc0321650d9a749e7a

                                                                                                                                  SHA1

                                                                                                                                  0faa4d2b42b1c4a08129438adc380b91ee0b1061

                                                                                                                                  SHA256

                                                                                                                                  514f59ddf399ebe031e256905374eedd86fe27ea835593f73195b01f3d1fb896

                                                                                                                                  SHA512

                                                                                                                                  d14c94b4c0af7a5fd748ccfb063425e3d94336ef959ee6777f939d15b57a7ee5f4939de1a316fc9972708f730f0fb285fb8be450141fc6ea0c15868e14c07313

                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  af99113584340ff00f61cb9a4d294634

                                                                                                                                  SHA1

                                                                                                                                  906679c6925c796159b74c5d80dd067a492c260a

                                                                                                                                  SHA256

                                                                                                                                  05608fdfd525a16b2438e8d8b7121a21b5ef141f9810c6317184c0ba70e824dd

                                                                                                                                  SHA512

                                                                                                                                  4876c36e31c4eb5755f44a7bb2d20798f64d0a00ab98d265db33001a30026541b7f5a7b82d3c3302f7ea85d138141093958631391ea9828a1a8fd7571ea070ff

                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  af99113584340ff00f61cb9a4d294634

                                                                                                                                  SHA1

                                                                                                                                  906679c6925c796159b74c5d80dd067a492c260a

                                                                                                                                  SHA256

                                                                                                                                  05608fdfd525a16b2438e8d8b7121a21b5ef141f9810c6317184c0ba70e824dd

                                                                                                                                  SHA512

                                                                                                                                  4876c36e31c4eb5755f44a7bb2d20798f64d0a00ab98d265db33001a30026541b7f5a7b82d3c3302f7ea85d138141093958631391ea9828a1a8fd7571ea070ff

                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  af99113584340ff00f61cb9a4d294634

                                                                                                                                  SHA1

                                                                                                                                  906679c6925c796159b74c5d80dd067a492c260a

                                                                                                                                  SHA256

                                                                                                                                  05608fdfd525a16b2438e8d8b7121a21b5ef141f9810c6317184c0ba70e824dd

                                                                                                                                  SHA512

                                                                                                                                  4876c36e31c4eb5755f44a7bb2d20798f64d0a00ab98d265db33001a30026541b7f5a7b82d3c3302f7ea85d138141093958631391ea9828a1a8fd7571ea070ff

                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\update.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  af99113584340ff00f61cb9a4d294634

                                                                                                                                  SHA1

                                                                                                                                  906679c6925c796159b74c5d80dd067a492c260a

                                                                                                                                  SHA256

                                                                                                                                  05608fdfd525a16b2438e8d8b7121a21b5ef141f9810c6317184c0ba70e824dd

                                                                                                                                  SHA512

                                                                                                                                  4876c36e31c4eb5755f44a7bb2d20798f64d0a00ab98d265db33001a30026541b7f5a7b82d3c3302f7ea85d138141093958631391ea9828a1a8fd7571ea070ff

                                                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  73cd5cc003050b036dc6dfb5743ef962

                                                                                                                                  SHA1

                                                                                                                                  86913a40f7dd7ac4e9633f86bdb8dc0e31c77715

                                                                                                                                  SHA256

                                                                                                                                  7b2df3ba47140ce5d3b54177cd730078079508fc37ae3c9ad87df17e9cdd48e3

                                                                                                                                  SHA512

                                                                                                                                  e82d13f2de6285eefa0fb28071845ce104f9e6b3d18a73615e43cc1b262c92e9056145d7422e02182c0e7b04f6c6f5a9ae210feb82b4d903b15819a41452d1dc

                                                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a66db196d9570bb99ad375ce674a6b54

                                                                                                                                  SHA1

                                                                                                                                  4bbcad02c1558987640f1d7c5f576cde98dd856f

                                                                                                                                  SHA256

                                                                                                                                  6e01707fd7a517d59504f9bae099ffff3e39677103ece2b360ca43e01b67f5c1

                                                                                                                                  SHA512

                                                                                                                                  6d20ccda7285a30dd2586dc921340a845c98e9452396e2e32467c7a1bbb25e28c36d43aa2bfb0276259743105b7a9cfba0b704c04a6efda3cb601f5307d2c18c

                                                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a66db196d9570bb99ad375ce674a6b54

                                                                                                                                  SHA1

                                                                                                                                  4bbcad02c1558987640f1d7c5f576cde98dd856f

                                                                                                                                  SHA256

                                                                                                                                  6e01707fd7a517d59504f9bae099ffff3e39677103ece2b360ca43e01b67f5c1

                                                                                                                                  SHA512

                                                                                                                                  6d20ccda7285a30dd2586dc921340a845c98e9452396e2e32467c7a1bbb25e28c36d43aa2bfb0276259743105b7a9cfba0b704c04a6efda3cb601f5307d2c18c

                                                                                                                                • memory/1924-121-0x00000000768A1000-0x00000000768A3000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                We care about your privacy.

                                                                                                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.