Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    157s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/10/2022, 06:16

General

  • Target

    ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe

  • Size

    72KB

  • MD5

    60044433f66464b86a9c16c269221497

  • SHA1

    d03211ff0fd444f291afe6f5b12b537687ff3537

  • SHA256

    ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f

  • SHA512

    73ca3d8b7277d0d0bbb7f08123feaecfbecb3f6224675517dbbcca252a0409a23990898d163c5a2e0b96978647b12f8ad2c2a9a3d1c3c50c1ae0d0d9ae4bfe7c

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2g:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrc

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe
    "C:\Users\Admin\AppData\Local\Temp\ab83c32fe1c213c5bd0524af7b53876939eea31ac2df89543d9be5de12b0c10f.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1764
    • C:\Users\Admin\AppData\Local\Temp\1350449190\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1350449190\backup.exe C:\Users\Admin\AppData\Local\Temp\1350449190\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2012
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1480
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1824
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1080
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1788
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1384
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1144
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1976
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1048
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1796
              • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:1668
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:568
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2040
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:764
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • System policy modification
                  PID:916
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1640
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1496
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1488
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1468
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1380
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:948
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1924
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1952
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1796
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1772
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    PID:1596
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                      PID:2040
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                      9⤵
                        PID:1720
                      • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                        9⤵
                          PID:1632
                        • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                          9⤵
                            PID:2076
                          • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                            9⤵
                              PID:2240
                            • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                              9⤵
                                PID:2344
                            • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1712
                            • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:2024
                            • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                              8⤵
                                PID:1740
                              • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe
                                "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                                8⤵
                                  PID:1760
                                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                                  8⤵
                                    PID:520
                                  • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                                    8⤵
                                      PID:2116
                                    • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                                      8⤵
                                        PID:2232
                                      • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                                        8⤵
                                          PID:2336
                                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:340
                                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:972
                                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1460
                                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1012
                                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                                          8⤵
                                            PID:1576
                                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                                            8⤵
                                              PID:1560
                                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                                              8⤵
                                                PID:1572
                                            • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                              7⤵
                                                PID:944
                                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                                7⤵
                                                  PID:1992
                                                • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                                                  "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                                  7⤵
                                                    PID:2020
                                                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                                    7⤵
                                                      PID:1104
                                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                                      7⤵
                                                        PID:2136
                                                      • C:\Program Files\Common Files\Microsoft Shared\VC\data.exe
                                                        "C:\Program Files\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                                        7⤵
                                                          PID:2268
                                                        • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                                          "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                                          7⤵
                                                            PID:2388
                                                        • C:\Program Files\Common Files\Services\backup.exe
                                                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                          6⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:1260
                                                        • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                                          "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                                          6⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:1744
                                                          • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                                            "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:1784
                                                        • C:\Program Files\Common Files\System\backup.exe
                                                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                          6⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1472
                                                          • C:\Program Files\Common Files\System\ado\backup.exe
                                                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                            7⤵
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:2028
                                                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              • Executes dropped EXE
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1488
                                                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:612
                                                            • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                              "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                              8⤵
                                                                PID:568
                                                              • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                                "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                                8⤵
                                                                  PID:1712
                                                                • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                                  "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                                  8⤵
                                                                    PID:1768
                                                                  • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                                    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                                    8⤵
                                                                      PID:1180
                                                                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                                    7⤵
                                                                      PID:1748
                                                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                                      7⤵
                                                                        PID:1380
                                                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                                        7⤵
                                                                          PID:1528
                                                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                          7⤵
                                                                            PID:1260
                                                                          • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                            "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                            7⤵
                                                                              PID:2152
                                                                            • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                              "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                              7⤵
                                                                                PID:2284
                                                                          • C:\Program Files\DVD Maker\backup.exe
                                                                            "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                                            5⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1184
                                                                            • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                                              "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:684
                                                                            • C:\Program Files\DVD Maker\en-US\backup.exe
                                                                              "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:568
                                                                            • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                              "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1988
                                                                            • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                              "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1724
                                                                            • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                              "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:1728
                                                                            • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                              "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                              6⤵
                                                                                PID:1464
                                                                              • C:\Program Files\DVD Maker\Shared\backup.exe
                                                                                "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                                                6⤵
                                                                                  PID:948
                                                                              • C:\Program Files\Google\backup.exe
                                                                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                PID:1540
                                                                              • C:\Program Files\Internet Explorer\backup.exe
                                                                                "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                5⤵
                                                                                  PID:380
                                                                                • C:\Program Files\Java\backup.exe
                                                                                  "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                  5⤵
                                                                                    PID:1664
                                                                                  • C:\Program Files\Microsoft Games\backup.exe
                                                                                    "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                    5⤵
                                                                                      PID:1964
                                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                      5⤵
                                                                                        PID:2100
                                                                                      • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                        5⤵
                                                                                          PID:2260
                                                                                      • C:\Program Files (x86)\backup.exe
                                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                        4⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Executes dropped EXE
                                                                                        • Loads dropped DLL
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1444
                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                          5⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Loads dropped DLL
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1980
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                            6⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Executes dropped EXE
                                                                                            • Loads dropped DLL
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:1704
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                              7⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1544
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                              7⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Executes dropped EXE
                                                                                              • Drops file in Program Files directory
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              • System policy modification
                                                                                              PID:1972
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1120
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:108
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:764
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Program Files directory
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1760
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                  9⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  PID:1560
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                8⤵
                                                                                                  PID:684
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                  8⤵
                                                                                                    PID:1524
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                    8⤵
                                                                                                      PID:1744
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                      8⤵
                                                                                                        PID:1100
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                        8⤵
                                                                                                          PID:2108
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                          8⤵
                                                                                                            PID:2200
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                            8⤵
                                                                                                              PID:2380
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                            7⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Program Files directory
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • System policy modification
                                                                                                            PID:1072
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                              8⤵
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              PID:1120
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                                              8⤵
                                                                                                                PID:1676
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
                                                                                                                8⤵
                                                                                                                  PID:1580
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
                                                                                                                  8⤵
                                                                                                                    PID:1012
                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
                                                                                                                    8⤵
                                                                                                                      PID:2128
                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                    7⤵
                                                                                                                      PID:872
                                                                                                                • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                  5⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Drops file in Program Files directory
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  • System policy modification
                                                                                                                  PID:988
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                    6⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:1532
                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                    6⤵
                                                                                                                      PID:1708
                                                                                                                    • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                      6⤵
                                                                                                                        PID:1396
                                                                                                                      • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                        6⤵
                                                                                                                          PID:1688
                                                                                                                        • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                          "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                          6⤵
                                                                                                                            PID:2092
                                                                                                                          • C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
                                                                                                                            "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                                            6⤵
                                                                                                                              PID:2208
                                                                                                                            • C:\Program Files (x86)\Common Files\System\backup.exe
                                                                                                                              "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
                                                                                                                              6⤵
                                                                                                                                PID:2360
                                                                                                                            • C:\Program Files (x86)\Google\backup.exe
                                                                                                                              "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                              5⤵
                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              • System policy modification
                                                                                                                              PID:1056
                                                                                                                              • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                                                "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                                                6⤵
                                                                                                                                  PID:2324
                                                                                                                              • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                5⤵
                                                                                                                                  PID:1544
                                                                                                                                • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                  5⤵
                                                                                                                                    PID:1292
                                                                                                                                  • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                    5⤵
                                                                                                                                      PID:2064
                                                                                                                                    • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                      5⤵
                                                                                                                                        PID:2252
                                                                                                                                    • C:\Users\backup.exe
                                                                                                                                      C:\Users\backup.exe C:\Users\
                                                                                                                                      4⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                      PID:1076
                                                                                                                                      • C:\Users\Admin\backup.exe
                                                                                                                                        C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                        5⤵
                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                        • System policy modification
                                                                                                                                        PID:1036
                                                                                                                                        • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                          C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                          6⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • System policy modification
                                                                                                                                          PID:1780
                                                                                                                                        • C:\Users\Admin\Desktop\update.exe
                                                                                                                                          C:\Users\Admin\Desktop\update.exe C:\Users\Admin\Desktop\
                                                                                                                                          6⤵
                                                                                                                                            PID:2032
                                                                                                                                          • C:\Users\Admin\Documents\backup.exe
                                                                                                                                            C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                            6⤵
                                                                                                                                              PID:2008
                                                                                                                                            • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                              C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                              6⤵
                                                                                                                                                PID:1996
                                                                                                                                              • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                6⤵
                                                                                                                                                  PID:2084
                                                                                                                                                • C:\Users\Admin\Links\backup.exe
                                                                                                                                                  C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                  6⤵
                                                                                                                                                    PID:2224
                                                                                                                                                  • C:\Users\Admin\Music\data.exe
                                                                                                                                                    C:\Users\Admin\Music\data.exe C:\Users\Admin\Music\
                                                                                                                                                    6⤵
                                                                                                                                                      PID:2352
                                                                                                                                                  • C:\Users\Public\backup.exe
                                                                                                                                                    C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1052
                                                                                                                                                  • C:\Windows\backup.exe
                                                                                                                                                    C:\Windows\backup.exe C:\Windows\
                                                                                                                                                    4⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:968
                                                                                                                                                    • C:\Windows\addins\backup.exe
                                                                                                                                                      C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                      5⤵
                                                                                                                                                        PID:1020
                                                                                                                                                      • C:\Windows\AppCompat\backup.exe
                                                                                                                                                        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                                        5⤵
                                                                                                                                                          PID:972
                                                                                                                                                        • C:\Windows\AppPatch\backup.exe
                                                                                                                                                          C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2216
                                                                                                                                                          • C:\Windows\assembly\backup.exe
                                                                                                                                                            C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                            5⤵
                                                                                                                                                              PID:2312
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                        2⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:1488
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:1592
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                        2⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:1252
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                        2⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        PID:760
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                        2⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:1604
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                        2⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                        • System policy modification
                                                                                                                                                        PID:1268

                                                                                                                                                    Network

                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                    Replay Monitor

                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                    Downloads

                                                                                                                                                    • C:\PerfLogs\Admin\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      32350becc952b3a9919a2550dcd91bf6

                                                                                                                                                      SHA1

                                                                                                                                                      9eeffe4bed46a7e12689c4952a8cc2e1caf72362

                                                                                                                                                      SHA256

                                                                                                                                                      510e8c3dda959a4b20a6af0284cac0e2d894049e470a0b7da66930001bf742fa

                                                                                                                                                      SHA512

                                                                                                                                                      cc0366306b3427f726db97510fae060a7f5f480c2c6aedfb6621c19770daf76dbde66ad535c66caf0c32994bc3929af20348761574aab5c43a3b8d4608dae04c

                                                                                                                                                    • C:\PerfLogs\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      cd0debb6656a422bad56b230e9f0fa3a

                                                                                                                                                      SHA1

                                                                                                                                                      c318460efeea117a6f385e68a2d3acfb07265cb7

                                                                                                                                                      SHA256

                                                                                                                                                      318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46

                                                                                                                                                      SHA512

                                                                                                                                                      a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f

                                                                                                                                                    • C:\PerfLogs\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      cd0debb6656a422bad56b230e9f0fa3a

                                                                                                                                                      SHA1

                                                                                                                                                      c318460efeea117a6f385e68a2d3acfb07265cb7

                                                                                                                                                      SHA256

                                                                                                                                                      318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46

                                                                                                                                                      SHA512

                                                                                                                                                      a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f

                                                                                                                                                    • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      64e7421265bea861b3d87f7549a17e73

                                                                                                                                                      SHA1

                                                                                                                                                      5dcd7665fceb4477d5e04a46cb775c17fa203ea1

                                                                                                                                                      SHA256

                                                                                                                                                      0c91e30ab689c1d608983ba9d8f6de6884a3b6f82fc7f1c146417fcd71402215

                                                                                                                                                      SHA512

                                                                                                                                                      3b52fc295f0734e589447f6c6ee6c1f9d1bc54e812ac32dcd5c18b95f852da8307600cef22bc91ed515a0b4a40b8ad213334e27af3fff46aa6472ab0a2c1da97

                                                                                                                                                    • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      aa59de42bb02c54924b84a1ae56f8ead

                                                                                                                                                      SHA1

                                                                                                                                                      801801c94bb6540f8ecb824be60e599d293fd9f0

                                                                                                                                                      SHA256

                                                                                                                                                      aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721

                                                                                                                                                      SHA512

                                                                                                                                                      88d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb

                                                                                                                                                    • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      aa59de42bb02c54924b84a1ae56f8ead

                                                                                                                                                      SHA1

                                                                                                                                                      801801c94bb6540f8ecb824be60e599d293fd9f0

                                                                                                                                                      SHA256

                                                                                                                                                      aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721

                                                                                                                                                      SHA512

                                                                                                                                                      88d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      de7da1787c3f02b7d5b918595c803859

                                                                                                                                                      SHA1

                                                                                                                                                      876cf63967a1ee8652b66c7b34aea39cd1be8947

                                                                                                                                                      SHA256

                                                                                                                                                      aca5f4e65a8e4f2469102a14d5519e72d543c84b1d1f934b3698703192287e4d

                                                                                                                                                      SHA512

                                                                                                                                                      1b5a2d56efe569e59839cd0a80075649745745abcfa6e8076b8301adfcc1b4b264ec0179d96f87fdabe0cb077ca25a3360d7ed4cb5fa7201da703ac249e90fa9

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e38fc6d23fd2d40ac2d461b5c2c97a90

                                                                                                                                                      SHA1

                                                                                                                                                      08c39b905a27b3a6956039c35557fe86a96d5717

                                                                                                                                                      SHA256

                                                                                                                                                      faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a

                                                                                                                                                      SHA512

                                                                                                                                                      92175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e38fc6d23fd2d40ac2d461b5c2c97a90

                                                                                                                                                      SHA1

                                                                                                                                                      08c39b905a27b3a6956039c35557fe86a96d5717

                                                                                                                                                      SHA256

                                                                                                                                                      faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a

                                                                                                                                                      SHA512

                                                                                                                                                      92175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      0d12972d15db80dcfc525cf3f218fe47

                                                                                                                                                      SHA1

                                                                                                                                                      4d629606be8d7811d1b72639cae1dc31b0629577

                                                                                                                                                      SHA256

                                                                                                                                                      9946cd1aa501ed442b19dc292e632cb6771742d5c977a19ee3aebea4e803ea1a

                                                                                                                                                      SHA512

                                                                                                                                                      3d15ee11de42176b44d4535914f042aa7abd59283d7858bccc27693df4a1c42022aec3c3013cbe3329993d86590a5d53e2f8a0ee9890264d4f04ef3712fc187c

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      f65c69e2d2095dcfb78080d0bfd92e2b

                                                                                                                                                      SHA1

                                                                                                                                                      e556195e1a420b9d1dc86506f8a5080c906407de

                                                                                                                                                      SHA256

                                                                                                                                                      8b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558

                                                                                                                                                      SHA512

                                                                                                                                                      fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32

                                                                                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      f65c69e2d2095dcfb78080d0bfd92e2b

                                                                                                                                                      SHA1

                                                                                                                                                      e556195e1a420b9d1dc86506f8a5080c906407de

                                                                                                                                                      SHA256

                                                                                                                                                      8b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558

                                                                                                                                                      SHA512

                                                                                                                                                      fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32

                                                                                                                                                    • C:\Program Files\Common Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bcf7ebd80ba544925ab058160f276ed8

                                                                                                                                                      SHA1

                                                                                                                                                      d79e5ebee9f54d4d47f42e78232729416cf64338

                                                                                                                                                      SHA256

                                                                                                                                                      a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9

                                                                                                                                                      SHA512

                                                                                                                                                      b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5

                                                                                                                                                    • C:\Program Files\Common Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bcf7ebd80ba544925ab058160f276ed8

                                                                                                                                                      SHA1

                                                                                                                                                      d79e5ebee9f54d4d47f42e78232729416cf64338

                                                                                                                                                      SHA256

                                                                                                                                                      a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9

                                                                                                                                                      SHA512

                                                                                                                                                      b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5

                                                                                                                                                    • C:\Program Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bbf7c143fba23a6ecc6af279eb42d707

                                                                                                                                                      SHA1

                                                                                                                                                      64ee2b5d56d14dfd127f60f7191e92b48032bd01

                                                                                                                                                      SHA256

                                                                                                                                                      3f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510

                                                                                                                                                      SHA512

                                                                                                                                                      efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903

                                                                                                                                                    • C:\Program Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bbf7c143fba23a6ecc6af279eb42d707

                                                                                                                                                      SHA1

                                                                                                                                                      64ee2b5d56d14dfd127f60f7191e92b48032bd01

                                                                                                                                                      SHA256

                                                                                                                                                      3f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510

                                                                                                                                                      SHA512

                                                                                                                                                      efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1350449190\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8c8edfe082247d1025585dd714cdc0e5

                                                                                                                                                      SHA1

                                                                                                                                                      01e59bab2877b687581bc8c46a803500400af220

                                                                                                                                                      SHA256

                                                                                                                                                      e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09

                                                                                                                                                      SHA512

                                                                                                                                                      9e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\1350449190\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8c8edfe082247d1025585dd714cdc0e5

                                                                                                                                                      SHA1

                                                                                                                                                      01e59bab2877b687581bc8c46a803500400af220

                                                                                                                                                      SHA256

                                                                                                                                                      e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09

                                                                                                                                                      SHA512

                                                                                                                                                      9e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8f042508fe60117e425c69088be0a357

                                                                                                                                                      SHA1

                                                                                                                                                      29c9bf4df911e8011a4abaa09c3d1d5c2115f3dd

                                                                                                                                                      SHA256

                                                                                                                                                      2722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77

                                                                                                                                                      SHA512

                                                                                                                                                      e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8f042508fe60117e425c69088be0a357

                                                                                                                                                      SHA1

                                                                                                                                                      29c9bf4df911e8011a4abaa09c3d1d5c2115f3dd

                                                                                                                                                      SHA256

                                                                                                                                                      2722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77

                                                                                                                                                      SHA512

                                                                                                                                                      e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e6492ee8990f05bacfd1a80c2be42bcc

                                                                                                                                                      SHA1

                                                                                                                                                      78bb078dac21435ccaaa0712bddf0202aabe06d2

                                                                                                                                                      SHA256

                                                                                                                                                      825f6e9f5e39ba1faf76189ea2ec26135ac678706a3021156841cf4c086caeb7

                                                                                                                                                      SHA512

                                                                                                                                                      085844b7dc63f46005be286ca512e99e03496eb5126d832b426bf7cb08e4530b201a3b5efdfcf8306d3602bcac19068745ed3d7f43b2dc4b0d495056c78bd9a4

                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      4d6a79c5e03428d0bc65eb2e2f1a3f75

                                                                                                                                                      SHA1

                                                                                                                                                      428327fb1624cbd4310e69d07d3f3b5999fe1bea

                                                                                                                                                      SHA256

                                                                                                                                                      ae5cf0475b5a8ec2ef97307d03f87d3fcf7732734c13b4b1eb600fc3d0d5c55d

                                                                                                                                                      SHA512

                                                                                                                                                      f04d909a5a4a383baf68e8b2fb31bf82d58a525bfeeae587ad05f634e7e782a01bb9e094104987af3737df05e9f147b9d8025df3c57f6ad63554ba075d5b51fa

                                                                                                                                                    • C:\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      b7142fe2d26b4b88caa27eb984b2d4eb

                                                                                                                                                      SHA1

                                                                                                                                                      104cae5f1fd5dedab17dbe6b09f3ffb3ab549db0

                                                                                                                                                      SHA256

                                                                                                                                                      8917d72a41d57047c91e1c1b87daf7c2a62955cda35883f41e1623eff65d37d8

                                                                                                                                                      SHA512

                                                                                                                                                      729ddb464d476365ac970509f52157ba4d150671162d2f7738c5e6c853ccb1a5245574abc9f1f8ac475bd0b7643d76d08f3f804b8b08f3ab2d1d17e317f92201

                                                                                                                                                    • C:\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      b7142fe2d26b4b88caa27eb984b2d4eb

                                                                                                                                                      SHA1

                                                                                                                                                      104cae5f1fd5dedab17dbe6b09f3ffb3ab549db0

                                                                                                                                                      SHA256

                                                                                                                                                      8917d72a41d57047c91e1c1b87daf7c2a62955cda35883f41e1623eff65d37d8

                                                                                                                                                      SHA512

                                                                                                                                                      729ddb464d476365ac970509f52157ba4d150671162d2f7738c5e6c853ccb1a5245574abc9f1f8ac475bd0b7643d76d08f3f804b8b08f3ab2d1d17e317f92201

                                                                                                                                                    • \PerfLogs\Admin\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      32350becc952b3a9919a2550dcd91bf6

                                                                                                                                                      SHA1

                                                                                                                                                      9eeffe4bed46a7e12689c4952a8cc2e1caf72362

                                                                                                                                                      SHA256

                                                                                                                                                      510e8c3dda959a4b20a6af0284cac0e2d894049e470a0b7da66930001bf742fa

                                                                                                                                                      SHA512

                                                                                                                                                      cc0366306b3427f726db97510fae060a7f5f480c2c6aedfb6621c19770daf76dbde66ad535c66caf0c32994bc3929af20348761574aab5c43a3b8d4608dae04c

                                                                                                                                                    • \PerfLogs\Admin\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      32350becc952b3a9919a2550dcd91bf6

                                                                                                                                                      SHA1

                                                                                                                                                      9eeffe4bed46a7e12689c4952a8cc2e1caf72362

                                                                                                                                                      SHA256

                                                                                                                                                      510e8c3dda959a4b20a6af0284cac0e2d894049e470a0b7da66930001bf742fa

                                                                                                                                                      SHA512

                                                                                                                                                      cc0366306b3427f726db97510fae060a7f5f480c2c6aedfb6621c19770daf76dbde66ad535c66caf0c32994bc3929af20348761574aab5c43a3b8d4608dae04c

                                                                                                                                                    • \PerfLogs\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      cd0debb6656a422bad56b230e9f0fa3a

                                                                                                                                                      SHA1

                                                                                                                                                      c318460efeea117a6f385e68a2d3acfb07265cb7

                                                                                                                                                      SHA256

                                                                                                                                                      318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46

                                                                                                                                                      SHA512

                                                                                                                                                      a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f

                                                                                                                                                    • \PerfLogs\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      cd0debb6656a422bad56b230e9f0fa3a

                                                                                                                                                      SHA1

                                                                                                                                                      c318460efeea117a6f385e68a2d3acfb07265cb7

                                                                                                                                                      SHA256

                                                                                                                                                      318e1488e43e676083a2fe0a9414658bddfd96c5327303c33d5270c4f2ab9a46

                                                                                                                                                      SHA512

                                                                                                                                                      a5bc5617755589b5ccf4e8beab8edaa9908274ada5dba456eab6c251b04ca240c6309b0cd88decab309262c9ccb01671d3be6d0f96b1d91677b4252b6865120f

                                                                                                                                                    • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      64e7421265bea861b3d87f7549a17e73

                                                                                                                                                      SHA1

                                                                                                                                                      5dcd7665fceb4477d5e04a46cb775c17fa203ea1

                                                                                                                                                      SHA256

                                                                                                                                                      0c91e30ab689c1d608983ba9d8f6de6884a3b6f82fc7f1c146417fcd71402215

                                                                                                                                                      SHA512

                                                                                                                                                      3b52fc295f0734e589447f6c6ee6c1f9d1bc54e812ac32dcd5c18b95f852da8307600cef22bc91ed515a0b4a40b8ad213334e27af3fff46aa6472ab0a2c1da97

                                                                                                                                                    • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      64e7421265bea861b3d87f7549a17e73

                                                                                                                                                      SHA1

                                                                                                                                                      5dcd7665fceb4477d5e04a46cb775c17fa203ea1

                                                                                                                                                      SHA256

                                                                                                                                                      0c91e30ab689c1d608983ba9d8f6de6884a3b6f82fc7f1c146417fcd71402215

                                                                                                                                                      SHA512

                                                                                                                                                      3b52fc295f0734e589447f6c6ee6c1f9d1bc54e812ac32dcd5c18b95f852da8307600cef22bc91ed515a0b4a40b8ad213334e27af3fff46aa6472ab0a2c1da97

                                                                                                                                                    • \Program Files\7-Zip\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      aa59de42bb02c54924b84a1ae56f8ead

                                                                                                                                                      SHA1

                                                                                                                                                      801801c94bb6540f8ecb824be60e599d293fd9f0

                                                                                                                                                      SHA256

                                                                                                                                                      aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721

                                                                                                                                                      SHA512

                                                                                                                                                      88d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb

                                                                                                                                                    • \Program Files\7-Zip\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      aa59de42bb02c54924b84a1ae56f8ead

                                                                                                                                                      SHA1

                                                                                                                                                      801801c94bb6540f8ecb824be60e599d293fd9f0

                                                                                                                                                      SHA256

                                                                                                                                                      aa9f4595cd6432eabb94efb09a490caf1d11466054cf88af4cc524b52f2a6721

                                                                                                                                                      SHA512

                                                                                                                                                      88d4e6332255fe16dff5ca2246d97fd3bceb16d76f58048225036d3e281a487861fdeffe22f3a385d307688b9a8ac335d0e3034c7e3fea7556926fc14223c2eb

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      de7da1787c3f02b7d5b918595c803859

                                                                                                                                                      SHA1

                                                                                                                                                      876cf63967a1ee8652b66c7b34aea39cd1be8947

                                                                                                                                                      SHA256

                                                                                                                                                      aca5f4e65a8e4f2469102a14d5519e72d543c84b1d1f934b3698703192287e4d

                                                                                                                                                      SHA512

                                                                                                                                                      1b5a2d56efe569e59839cd0a80075649745745abcfa6e8076b8301adfcc1b4b264ec0179d96f87fdabe0cb077ca25a3360d7ed4cb5fa7201da703ac249e90fa9

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      de7da1787c3f02b7d5b918595c803859

                                                                                                                                                      SHA1

                                                                                                                                                      876cf63967a1ee8652b66c7b34aea39cd1be8947

                                                                                                                                                      SHA256

                                                                                                                                                      aca5f4e65a8e4f2469102a14d5519e72d543c84b1d1f934b3698703192287e4d

                                                                                                                                                      SHA512

                                                                                                                                                      1b5a2d56efe569e59839cd0a80075649745745abcfa6e8076b8301adfcc1b4b264ec0179d96f87fdabe0cb077ca25a3360d7ed4cb5fa7201da703ac249e90fa9

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e38fc6d23fd2d40ac2d461b5c2c97a90

                                                                                                                                                      SHA1

                                                                                                                                                      08c39b905a27b3a6956039c35557fe86a96d5717

                                                                                                                                                      SHA256

                                                                                                                                                      faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a

                                                                                                                                                      SHA512

                                                                                                                                                      92175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e38fc6d23fd2d40ac2d461b5c2c97a90

                                                                                                                                                      SHA1

                                                                                                                                                      08c39b905a27b3a6956039c35557fe86a96d5717

                                                                                                                                                      SHA256

                                                                                                                                                      faefbd81bece42db71b5031cc791e98a1a75de4c71e4762aca9925e93c14213a

                                                                                                                                                      SHA512

                                                                                                                                                      92175977a85de4600bc13c211d78a98bcfeee6d0ec24c841078b5fdc49672abd3d2674e8f1fcceaef3a1adaad057c493ae8645e1ef1bb88fc8c11a1c84d29696

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      645e16c21e6755d996b100996cab30ee

                                                                                                                                                      SHA1

                                                                                                                                                      f6b66806a2f2d8d65b89ac3669cdee0d40b5f7a9

                                                                                                                                                      SHA256

                                                                                                                                                      414894d8dfee0db0a2f0e210aa7a66ea4bea476049e853a3f716ed3cbe90f582

                                                                                                                                                      SHA512

                                                                                                                                                      78503b510e1d9ff38b7fc324ce340ad5dd26645179da1ecbc0d2b0ac927cb1eff8a79265e29486878ec82e13a7343e4558e8d668ba6ac64eece517db8f4b8469

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      0d12972d15db80dcfc525cf3f218fe47

                                                                                                                                                      SHA1

                                                                                                                                                      4d629606be8d7811d1b72639cae1dc31b0629577

                                                                                                                                                      SHA256

                                                                                                                                                      9946cd1aa501ed442b19dc292e632cb6771742d5c977a19ee3aebea4e803ea1a

                                                                                                                                                      SHA512

                                                                                                                                                      3d15ee11de42176b44d4535914f042aa7abd59283d7858bccc27693df4a1c42022aec3c3013cbe3329993d86590a5d53e2f8a0ee9890264d4f04ef3712fc187c

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      0d12972d15db80dcfc525cf3f218fe47

                                                                                                                                                      SHA1

                                                                                                                                                      4d629606be8d7811d1b72639cae1dc31b0629577

                                                                                                                                                      SHA256

                                                                                                                                                      9946cd1aa501ed442b19dc292e632cb6771742d5c977a19ee3aebea4e803ea1a

                                                                                                                                                      SHA512

                                                                                                                                                      3d15ee11de42176b44d4535914f042aa7abd59283d7858bccc27693df4a1c42022aec3c3013cbe3329993d86590a5d53e2f8a0ee9890264d4f04ef3712fc187c

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      f65c69e2d2095dcfb78080d0bfd92e2b

                                                                                                                                                      SHA1

                                                                                                                                                      e556195e1a420b9d1dc86506f8a5080c906407de

                                                                                                                                                      SHA256

                                                                                                                                                      8b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558

                                                                                                                                                      SHA512

                                                                                                                                                      fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32

                                                                                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      f65c69e2d2095dcfb78080d0bfd92e2b

                                                                                                                                                      SHA1

                                                                                                                                                      e556195e1a420b9d1dc86506f8a5080c906407de

                                                                                                                                                      SHA256

                                                                                                                                                      8b8001c1394ab508ae0ce8cffdacb2f304a0ee990696fb15ff09c17687ccb558

                                                                                                                                                      SHA512

                                                                                                                                                      fe7e01ff7343e78729c7f5ea26ce0244471c9679845d61a136d5eff6d4ac3490621b1c4489653ee58be922c947feb45aa61cbd655d44fad5f7390fcc52fdec32

                                                                                                                                                    • \Program Files\Common Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bcf7ebd80ba544925ab058160f276ed8

                                                                                                                                                      SHA1

                                                                                                                                                      d79e5ebee9f54d4d47f42e78232729416cf64338

                                                                                                                                                      SHA256

                                                                                                                                                      a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9

                                                                                                                                                      SHA512

                                                                                                                                                      b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5

                                                                                                                                                    • \Program Files\Common Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bcf7ebd80ba544925ab058160f276ed8

                                                                                                                                                      SHA1

                                                                                                                                                      d79e5ebee9f54d4d47f42e78232729416cf64338

                                                                                                                                                      SHA256

                                                                                                                                                      a199d7324fe5d23c7a6a25e86df5b9b5010e2b37ce62c8b6bc7de7bde1d6e1c9

                                                                                                                                                      SHA512

                                                                                                                                                      b4d7c2e3e517add8d5b215aaff5af223f4e665f2fdb71c67743502b054d2094c1b1ac52054b95b43743159c73c0f04378b58457dde3563cdb4a7c27a56afa0f5

                                                                                                                                                    • \Program Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bbf7c143fba23a6ecc6af279eb42d707

                                                                                                                                                      SHA1

                                                                                                                                                      64ee2b5d56d14dfd127f60f7191e92b48032bd01

                                                                                                                                                      SHA256

                                                                                                                                                      3f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510

                                                                                                                                                      SHA512

                                                                                                                                                      efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903

                                                                                                                                                    • \Program Files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      bbf7c143fba23a6ecc6af279eb42d707

                                                                                                                                                      SHA1

                                                                                                                                                      64ee2b5d56d14dfd127f60f7191e92b48032bd01

                                                                                                                                                      SHA256

                                                                                                                                                      3f786a2112011544d4d61c4b03f866ac84cb37eccdab5de44fab124d7860d510

                                                                                                                                                      SHA512

                                                                                                                                                      efcca5528fcb854e271fe30bba4a271416a9bd6cca21e41bdf585f220d394269b4be79f427425ea50c0dac95059508a66e6e0b93b7c13d98d31a0f5ec21f8903

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\1350449190\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8c8edfe082247d1025585dd714cdc0e5

                                                                                                                                                      SHA1

                                                                                                                                                      01e59bab2877b687581bc8c46a803500400af220

                                                                                                                                                      SHA256

                                                                                                                                                      e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09

                                                                                                                                                      SHA512

                                                                                                                                                      9e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\1350449190\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8c8edfe082247d1025585dd714cdc0e5

                                                                                                                                                      SHA1

                                                                                                                                                      01e59bab2877b687581bc8c46a803500400af220

                                                                                                                                                      SHA256

                                                                                                                                                      e9e172e22880bf3534f17a48dd49c9d3c07782bacd60989eb3b3e3b63bd9da09

                                                                                                                                                      SHA512

                                                                                                                                                      9e57b44e947015295f321f9fd7f492bee660e099c621904bba0b106418dbb03b64b451e457faa1e627d267bea784fe3294f70a7bf9a1138a7f6d9ad7a5b119c6

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8f042508fe60117e425c69088be0a357

                                                                                                                                                      SHA1

                                                                                                                                                      29c9bf4df911e8011a4abaa09c3d1d5c2115f3dd

                                                                                                                                                      SHA256

                                                                                                                                                      2722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77

                                                                                                                                                      SHA512

                                                                                                                                                      e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8f042508fe60117e425c69088be0a357

                                                                                                                                                      SHA1

                                                                                                                                                      29c9bf4df911e8011a4abaa09c3d1d5c2115f3dd

                                                                                                                                                      SHA256

                                                                                                                                                      2722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77

                                                                                                                                                      SHA512

                                                                                                                                                      e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8f042508fe60117e425c69088be0a357

                                                                                                                                                      SHA1

                                                                                                                                                      29c9bf4df911e8011a4abaa09c3d1d5c2115f3dd

                                                                                                                                                      SHA256

                                                                                                                                                      2722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77

                                                                                                                                                      SHA512

                                                                                                                                                      e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      8f042508fe60117e425c69088be0a357

                                                                                                                                                      SHA1

                                                                                                                                                      29c9bf4df911e8011a4abaa09c3d1d5c2115f3dd

                                                                                                                                                      SHA256

                                                                                                                                                      2722117195a549973dd633479849aad3e0223c53e15ba9fe5e726956e1a18f77

                                                                                                                                                      SHA512

                                                                                                                                                      e441cf21945f81a43203bc7bf19d9e75c18b6410109854f20ed674a3e08800726b3d769765f085abfe6c98aafe723c2c076168519b4a6412bbc45ad9f4dd97da

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e6492ee8990f05bacfd1a80c2be42bcc

                                                                                                                                                      SHA1

                                                                                                                                                      78bb078dac21435ccaaa0712bddf0202aabe06d2

                                                                                                                                                      SHA256

                                                                                                                                                      825f6e9f5e39ba1faf76189ea2ec26135ac678706a3021156841cf4c086caeb7

                                                                                                                                                      SHA512

                                                                                                                                                      085844b7dc63f46005be286ca512e99e03496eb5126d832b426bf7cb08e4530b201a3b5efdfcf8306d3602bcac19068745ed3d7f43b2dc4b0d495056c78bd9a4

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      e6492ee8990f05bacfd1a80c2be42bcc

                                                                                                                                                      SHA1

                                                                                                                                                      78bb078dac21435ccaaa0712bddf0202aabe06d2

                                                                                                                                                      SHA256

                                                                                                                                                      825f6e9f5e39ba1faf76189ea2ec26135ac678706a3021156841cf4c086caeb7

                                                                                                                                                      SHA512

                                                                                                                                                      085844b7dc63f46005be286ca512e99e03496eb5126d832b426bf7cb08e4530b201a3b5efdfcf8306d3602bcac19068745ed3d7f43b2dc4b0d495056c78bd9a4

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      4d6a79c5e03428d0bc65eb2e2f1a3f75

                                                                                                                                                      SHA1

                                                                                                                                                      428327fb1624cbd4310e69d07d3f3b5999fe1bea

                                                                                                                                                      SHA256

                                                                                                                                                      ae5cf0475b5a8ec2ef97307d03f87d3fcf7732734c13b4b1eb600fc3d0d5c55d

                                                                                                                                                      SHA512

                                                                                                                                                      f04d909a5a4a383baf68e8b2fb31bf82d58a525bfeeae587ad05f634e7e782a01bb9e094104987af3737df05e9f147b9d8025df3c57f6ad63554ba075d5b51fa

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      4d6a79c5e03428d0bc65eb2e2f1a3f75

                                                                                                                                                      SHA1

                                                                                                                                                      428327fb1624cbd4310e69d07d3f3b5999fe1bea

                                                                                                                                                      SHA256

                                                                                                                                                      ae5cf0475b5a8ec2ef97307d03f87d3fcf7732734c13b4b1eb600fc3d0d5c55d

                                                                                                                                                      SHA512

                                                                                                                                                      f04d909a5a4a383baf68e8b2fb31bf82d58a525bfeeae587ad05f634e7e782a01bb9e094104987af3737df05e9f147b9d8025df3c57f6ad63554ba075d5b51fa

                                                                                                                                                    • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                      Filesize

                                                                                                                                                      72KB

                                                                                                                                                      MD5

                                                                                                                                                      d99c0e11ef35b5e14105089ce2df50f3

                                                                                                                                                      SHA1

                                                                                                                                                      41659446ff94b9bed5e0baaf8ab11389fcb6f34b

                                                                                                                                                      SHA256

                                                                                                                                                      a0523740306ab01d55e149aa7693c3ff6ace69449cc447436dce5000770a674b

                                                                                                                                                      SHA512

                                                                                                                                                      0a26e8bd28a45a9d48a74b3fb3e9a2653c3166a3571f29b030f98de92f578fcf833c323671d04f228a6f858b0182790a9179f89dd90e41732faa5c454bfd7862

                                                                                                                                                    • memory/1764-193-0x0000000075FC1000-0x0000000075FC3000-memory.dmp

                                                                                                                                                      Filesize

                                                                                                                                                      8KB