Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    156s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    20/10/2022, 04:37

General

  • Target

    4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe

  • Size

    72KB

  • MD5

    8086a199ad7e768f5abca1cf10bb39ff

  • SHA1

    6948601c999fa8fd2a85830d4a0ea88483da4a1f

  • SHA256

    4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13

  • SHA512

    e4439bd7c6d21d10fd583e12c2539f3138eeef3ee94660c889006e9852b2f879b0ac4e050da96a8d2d5f091483646f79646398c2e04141879fe96684524d2938

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2y:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPm

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe
    "C:\Users\Admin\AppData\Local\Temp\4a5041d6fd15bb6df47626bb4016895c0f0ddf4e11a1c7149a3da10702289e13.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1976
    • C:\Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe
      "C:\Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\2910522919\
      2⤵
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2000
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1168
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1516
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1988
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:560
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1948
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1492
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1660
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1164
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1232
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1940
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:336
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1560
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1316
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:616
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1136
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1776
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2028
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:920
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1872
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1992
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1304
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1808
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1496
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1676
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2024
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:628
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1708
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1856
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2012
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1504
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1152
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1812
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1584
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:1084
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:1708
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:436
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                    PID:2044
                  • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                    8⤵
                      PID:1668
                    • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                      8⤵
                        PID:568
                      • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                        8⤵
                          PID:696
                        • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                          8⤵
                            PID:1908
                          • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                            8⤵
                              PID:1760
                            • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                              8⤵
                                PID:1444
                              • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                                8⤵
                                  PID:1112
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:524
                                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                                  8⤵
                                    PID:1544
                                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                                    8⤵
                                      PID:1816
                                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                                      8⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • System policy modification
                                      PID:584
                                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                                      8⤵
                                        PID:1180
                                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                                        8⤵
                                          PID:1692
                                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                                          8⤵
                                            PID:336
                                        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                          7⤵
                                          • System policy modification
                                          PID:1676
                                        • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                          7⤵
                                            PID:1064
                                          • C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                            7⤵
                                              PID:1576
                                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                              7⤵
                                                PID:2016
                                              • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                                "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                                7⤵
                                                  PID:628
                                                • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                                  "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                                  7⤵
                                                    PID:692
                                                  • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                                    "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                                    7⤵
                                                      PID:1716
                                                    • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                                      "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                                      7⤵
                                                        PID:1320
                                                    • C:\Program Files\Common Files\Services\System Restore.exe
                                                      "C:\Program Files\Common Files\Services\System Restore.exe" C:\Program Files\Common Files\Services\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1392
                                                    • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                                      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1264
                                                      • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                                        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:1232
                                                    • C:\Program Files\Common Files\System\backup.exe
                                                      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1052
                                                      • C:\Program Files\Common Files\System\ado\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:696
                                                        • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:752
                                                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Executes dropped EXE
                                                          PID:1392
                                                        • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                          8⤵
                                                          • Disables RegEdit via registry modification
                                                          PID:584
                                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System policy modification
                                                          PID:1840
                                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                          8⤵
                                                          • Disables RegEdit via registry modification
                                                          • System policy modification
                                                          PID:1720
                                                        • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                          8⤵
                                                          • Disables RegEdit via registry modification
                                                          • System policy modification
                                                          PID:2032
                                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                        7⤵
                                                          PID:912
                                                        • C:\Program Files\Common Files\System\en-US\backup.exe
                                                          "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                          7⤵
                                                            PID:1984
                                                          • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                            "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                            7⤵
                                                              PID:1580
                                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                              7⤵
                                                                PID:1316
                                                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                                7⤵
                                                                  PID:1964
                                                                • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                                  "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                                  7⤵
                                                                    PID:1312
                                                                  • C:\Program Files\Common Files\System\msadc\backup.exe
                                                                    "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                                    7⤵
                                                                      PID:1504
                                                                    • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                                      "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                                      7⤵
                                                                        PID:1432
                                                                  • C:\Program Files\DVD Maker\backup.exe
                                                                    "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                                    5⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:268
                                                                    • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                                      "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:1064
                                                                    • C:\Program Files\DVD Maker\en-US\data.exe
                                                                      "C:\Program Files\DVD Maker\en-US\data.exe" C:\Program Files\DVD Maker\en-US\
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:916
                                                                    • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                      "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1752
                                                                    • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                      "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1316
                                                                    • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                      "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:1108
                                                                    • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                      "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:2004
                                                                    • C:\Program Files\DVD Maker\Shared\backup.exe
                                                                      "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                                      6⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1776
                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe
                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                                        7⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1700
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                                          8⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:828
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:976
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:384
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:1232
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • System policy modification
                                                                          PID:1768
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:944
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
                                                                          8⤵
                                                                          • Disables RegEdit via registry modification
                                                                          • System policy modification
                                                                          PID:1536
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
                                                                          8⤵
                                                                            PID:1960
                                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
                                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
                                                                            8⤵
                                                                              PID:1452
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
                                                                              8⤵
                                                                                PID:1232
                                                                              • C:\Program Files\DVD Maker\Shared\DvdStyles\Push\System Restore.exe
                                                                                "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
                                                                                8⤵
                                                                                  PID:2036
                                                                                • C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
                                                                                  "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
                                                                                  8⤵
                                                                                    PID:1620
                                                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
                                                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
                                                                                    8⤵
                                                                                      PID:996
                                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe
                                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
                                                                                      8⤵
                                                                                        PID:1192
                                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
                                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
                                                                                        8⤵
                                                                                          PID:2104
                                                                                  • C:\Program Files\Google\backup.exe
                                                                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                    5⤵
                                                                                      PID:1744
                                                                                    • C:\Program Files\Internet Explorer\backup.exe
                                                                                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                      5⤵
                                                                                        PID:840
                                                                                      • C:\Program Files\Java\backup.exe
                                                                                        "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                        5⤵
                                                                                          PID:1560
                                                                                        • C:\Program Files\Microsoft Games\backup.exe
                                                                                          "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                          5⤵
                                                                                            PID:1216
                                                                                          • C:\Program Files\Microsoft Office\backup.exe
                                                                                            "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                            5⤵
                                                                                              PID:320
                                                                                            • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                              "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                              5⤵
                                                                                                PID:1588
                                                                                              • C:\Program Files\MSBuild\backup.exe
                                                                                                "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                                5⤵
                                                                                                  PID:828
                                                                                                • C:\Program Files\Reference Assemblies\System Restore.exe
                                                                                                  "C:\Program Files\Reference Assemblies\System Restore.exe" C:\Program Files\Reference Assemblies\
                                                                                                  5⤵
                                                                                                    PID:596
                                                                                                  • C:\Program Files\VideoLAN\backup.exe
                                                                                                    "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
                                                                                                    5⤵
                                                                                                      PID:2064
                                                                                                  • C:\Program Files (x86)\data.exe
                                                                                                    "C:\Program Files (x86)\data.exe" C:\Program Files (x86)\
                                                                                                    4⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Program Files directory
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • System policy modification
                                                                                                    PID:1636
                                                                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                      5⤵
                                                                                                      • Executes dropped EXE
                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                      PID:1572
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                                        6⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Program Files directory
                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                        • System policy modification
                                                                                                        PID:1876
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                          7⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Executes dropped EXE
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:1952
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\update.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                          7⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          • System policy modification
                                                                                                          PID:924
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                            8⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:1648
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                            8⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            PID:2028
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                            8⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                            • System policy modification
                                                                                                            PID:1388
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                            8⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System policy modification
                                                                                                            PID:1512
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                              9⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:1668
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                            8⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            PID:1576
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                            8⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Drops file in Program Files directory
                                                                                                            PID:1856
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                              9⤵
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              PID:1772
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                            8⤵
                                                                                                              PID:1368
                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                              8⤵
                                                                                                                PID:1464
                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                                8⤵
                                                                                                                  PID:1616
                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                                  8⤵
                                                                                                                    PID:988
                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                                    8⤵
                                                                                                                      PID:1304
                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                    7⤵
                                                                                                                      PID:1728
                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                      7⤵
                                                                                                                        PID:112
                                                                                                                  • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                    5⤵
                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    PID:1268
                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                      6⤵
                                                                                                                        PID:1176
                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                        6⤵
                                                                                                                          PID:2096
                                                                                                                      • C:\Program Files (x86)\Google\backup.exe
                                                                                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                        5⤵
                                                                                                                          PID:1968
                                                                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                          5⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          PID:1796
                                                                                                                          • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                            "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                            6⤵
                                                                                                                              PID:904
                                                                                                                            • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                              "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                              6⤵
                                                                                                                                PID:1568
                                                                                                                              • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                6⤵
                                                                                                                                  PID:1660
                                                                                                                                • C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\fr-FR\backup.exe" C:\Program Files (x86)\Internet Explorer\fr-FR\
                                                                                                                                  6⤵
                                                                                                                                    PID:1196
                                                                                                                                • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                  5⤵
                                                                                                                                    PID:2004
                                                                                                                                  • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                    5⤵
                                                                                                                                      PID:1160
                                                                                                                                    • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                      5⤵
                                                                                                                                        PID:1840
                                                                                                                                      • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                                        5⤵
                                                                                                                                          PID:1680
                                                                                                                                        • C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
                                                                                                                                          5⤵
                                                                                                                                            PID:1172
                                                                                                                                          • C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
                                                                                                                                            5⤵
                                                                                                                                              PID:2072
                                                                                                                                          • C:\Users\backup.exe
                                                                                                                                            C:\Users\backup.exe C:\Users\
                                                                                                                                            4⤵
                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                            • System policy modification
                                                                                                                                            PID:1980
                                                                                                                                            • C:\Users\Admin\backup.exe
                                                                                                                                              C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                              5⤵
                                                                                                                                                PID:1048
                                                                                                                                              • C:\Users\Public\backup.exe
                                                                                                                                                C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                5⤵
                                                                                                                                                  PID:1512
                                                                                                                                              • C:\Windows\backup.exe
                                                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                                                4⤵
                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:1364
                                                                                                                                                • C:\Windows\addins\backup.exe
                                                                                                                                                  C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                  5⤵
                                                                                                                                                    PID:268
                                                                                                                                                  • C:\Windows\AppCompat\backup.exe
                                                                                                                                                    C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                                    5⤵
                                                                                                                                                      PID:1648
                                                                                                                                                    • C:\Windows\AppPatch\data.exe
                                                                                                                                                      C:\Windows\AppPatch\data.exe C:\Windows\AppPatch\
                                                                                                                                                      5⤵
                                                                                                                                                        PID:1672
                                                                                                                                                      • C:\Windows\assembly\backup.exe
                                                                                                                                                        C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                        5⤵
                                                                                                                                                          PID:920
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:1192
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                    2⤵
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:1116
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:2016
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                    2⤵
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    PID:944
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:1964
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                    2⤵
                                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:1520

                                                                                                                                                Network

                                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\PerfLogs\Admin\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  2d3012d62421ae54f37319c90a265b33

                                                                                                                                                  SHA1

                                                                                                                                                  fe165777eed3206cd8bd590c2b750d8841186391

                                                                                                                                                  SHA256

                                                                                                                                                  4a51d82c9422075d5c99695f7dac45611cb3ab6bc17b66db273bc7413f037b6a

                                                                                                                                                  SHA512

                                                                                                                                                  4620c90f6a67caf727b8e2827e6cc5951171264bedd36a87e7c080487918c1d1ec7c2b7c8d5f1441d286e60c030a44f0c7e82419192a3c57e2e9f1e232f3b6fd

                                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  30f3f0662f594b426bc253a2a63472f3

                                                                                                                                                  SHA1

                                                                                                                                                  8dca41a248e74813bf7dd405b052880bac23d998

                                                                                                                                                  SHA256

                                                                                                                                                  720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114

                                                                                                                                                  SHA512

                                                                                                                                                  7692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e

                                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  30f3f0662f594b426bc253a2a63472f3

                                                                                                                                                  SHA1

                                                                                                                                                  8dca41a248e74813bf7dd405b052880bac23d998

                                                                                                                                                  SHA256

                                                                                                                                                  720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114

                                                                                                                                                  SHA512

                                                                                                                                                  7692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e

                                                                                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  ca604046794847c97baab2c854f98b44

                                                                                                                                                  SHA1

                                                                                                                                                  5d0b86028f6e3adb451b48753e765117b005b84a

                                                                                                                                                  SHA256

                                                                                                                                                  59b032d9c5ade3b8a693e04cfb51f72ef43c95fb2cd24fe246428b492ddb6237

                                                                                                                                                  SHA512

                                                                                                                                                  493d4288ec53f28d4200dbd478e82c4cb178c0865f7dfc20c220635d373a336ed81029fc761a9bdd5d54da42d7051a13168bf04c2bbb5685e927c009a27c5e1d

                                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  529638016d16cc16bea4145c5fd8a59f

                                                                                                                                                  SHA1

                                                                                                                                                  b42011d3e717049a9825c1d2141ef2dd20dc4e77

                                                                                                                                                  SHA256

                                                                                                                                                  dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101

                                                                                                                                                  SHA512

                                                                                                                                                  38a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148

                                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  529638016d16cc16bea4145c5fd8a59f

                                                                                                                                                  SHA1

                                                                                                                                                  b42011d3e717049a9825c1d2141ef2dd20dc4e77

                                                                                                                                                  SHA256

                                                                                                                                                  dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101

                                                                                                                                                  SHA512

                                                                                                                                                  38a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf7cc94b0772847719b0f4a9b149418f

                                                                                                                                                  SHA1

                                                                                                                                                  ac5ab6aa0ebaaf8a6e6c57492d1e6223541803f0

                                                                                                                                                  SHA256

                                                                                                                                                  33f66dc8635701903497e9d01211367be5d4eafde77db7f69f4ca154fa79efc8

                                                                                                                                                  SHA512

                                                                                                                                                  aeecdc1faf8a744f3271f565777b1aa46235df8874f0279e237688a8a0ddff541278e1820247ecc26fd7b86ca980c8d4cd4dc619309ddee724bb986b473877cb

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  322c8beed2a0e6b561977231813b822a

                                                                                                                                                  SHA1

                                                                                                                                                  debe222c958cf11c6c0612e6c0af39f934d909bc

                                                                                                                                                  SHA256

                                                                                                                                                  0698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536

                                                                                                                                                  SHA512

                                                                                                                                                  73ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  322c8beed2a0e6b561977231813b822a

                                                                                                                                                  SHA1

                                                                                                                                                  debe222c958cf11c6c0612e6c0af39f934d909bc

                                                                                                                                                  SHA256

                                                                                                                                                  0698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536

                                                                                                                                                  SHA512

                                                                                                                                                  73ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  17e00708f76dc190fdc841300664a92a

                                                                                                                                                  SHA1

                                                                                                                                                  0730165d9fce716eb7748e88db65506d98cbf0ce

                                                                                                                                                  SHA256

                                                                                                                                                  10085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a

                                                                                                                                                  SHA512

                                                                                                                                                  538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  d26661aa2a4636e1d31a4a22aebe557e

                                                                                                                                                  SHA1

                                                                                                                                                  4a8f128b6f03085ed001ffbb010b1555c59c7cfa

                                                                                                                                                  SHA256

                                                                                                                                                  c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85

                                                                                                                                                  SHA512

                                                                                                                                                  3830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  d26661aa2a4636e1d31a4a22aebe557e

                                                                                                                                                  SHA1

                                                                                                                                                  4a8f128b6f03085ed001ffbb010b1555c59c7cfa

                                                                                                                                                  SHA256

                                                                                                                                                  c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85

                                                                                                                                                  SHA512

                                                                                                                                                  3830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185

                                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  17e00708f76dc190fdc841300664a92a

                                                                                                                                                  SHA1

                                                                                                                                                  0730165d9fce716eb7748e88db65506d98cbf0ce

                                                                                                                                                  SHA256

                                                                                                                                                  10085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a

                                                                                                                                                  SHA512

                                                                                                                                                  538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219

                                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf168746d3f31d8a5736a9dca03d615a

                                                                                                                                                  SHA1

                                                                                                                                                  997231c8af098669857d202877e0693c997983eb

                                                                                                                                                  SHA256

                                                                                                                                                  c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f

                                                                                                                                                  SHA512

                                                                                                                                                  3783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0

                                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf168746d3f31d8a5736a9dca03d615a

                                                                                                                                                  SHA1

                                                                                                                                                  997231c8af098669857d202877e0693c997983eb

                                                                                                                                                  SHA256

                                                                                                                                                  c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f

                                                                                                                                                  SHA512

                                                                                                                                                  3783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0

                                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  cf548b065e5d8458d6587c84967b00f0

                                                                                                                                                  SHA1

                                                                                                                                                  735fa5e2898d68fd8a8e2a5d31f41cd5305956ec

                                                                                                                                                  SHA256

                                                                                                                                                  1d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144

                                                                                                                                                  SHA512

                                                                                                                                                  615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1

                                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  cf548b065e5d8458d6587c84967b00f0

                                                                                                                                                  SHA1

                                                                                                                                                  735fa5e2898d68fd8a8e2a5d31f41cd5305956ec

                                                                                                                                                  SHA256

                                                                                                                                                  1d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144

                                                                                                                                                  SHA512

                                                                                                                                                  615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  08f59b266367e8fb8e0f2fa79f406d9a

                                                                                                                                                  SHA1

                                                                                                                                                  c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa

                                                                                                                                                  SHA256

                                                                                                                                                  89c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93

                                                                                                                                                  SHA512

                                                                                                                                                  a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  08f59b266367e8fb8e0f2fa79f406d9a

                                                                                                                                                  SHA1

                                                                                                                                                  c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa

                                                                                                                                                  SHA256

                                                                                                                                                  89c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93

                                                                                                                                                  SHA512

                                                                                                                                                  a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3

                                                                                                                                                • C:\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  0e11d779e02232a95ee57644a11f6c8d

                                                                                                                                                  SHA1

                                                                                                                                                  c15f12dfc793371dc47cf474c17f7b7faa5dc907

                                                                                                                                                  SHA256

                                                                                                                                                  9226b277f75bbb2ab6ee4407ca1f642e99b1a0826e6c966404e02d470941dc8c

                                                                                                                                                  SHA512

                                                                                                                                                  cc7e600a6ead43889648ad017f79026130b5106f71f9fdac816210802badc64ec686f95689e76f89f8c03c4b5b22ffe8871b35685e3edf1c79faa0c099db1e65

                                                                                                                                                • C:\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  0e11d779e02232a95ee57644a11f6c8d

                                                                                                                                                  SHA1

                                                                                                                                                  c15f12dfc793371dc47cf474c17f7b7faa5dc907

                                                                                                                                                  SHA256

                                                                                                                                                  9226b277f75bbb2ab6ee4407ca1f642e99b1a0826e6c966404e02d470941dc8c

                                                                                                                                                  SHA512

                                                                                                                                                  cc7e600a6ead43889648ad017f79026130b5106f71f9fdac816210802badc64ec686f95689e76f89f8c03c4b5b22ffe8871b35685e3edf1c79faa0c099db1e65

                                                                                                                                                • \PerfLogs\Admin\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  2d3012d62421ae54f37319c90a265b33

                                                                                                                                                  SHA1

                                                                                                                                                  fe165777eed3206cd8bd590c2b750d8841186391

                                                                                                                                                  SHA256

                                                                                                                                                  4a51d82c9422075d5c99695f7dac45611cb3ab6bc17b66db273bc7413f037b6a

                                                                                                                                                  SHA512

                                                                                                                                                  4620c90f6a67caf727b8e2827e6cc5951171264bedd36a87e7c080487918c1d1ec7c2b7c8d5f1441d286e60c030a44f0c7e82419192a3c57e2e9f1e232f3b6fd

                                                                                                                                                • \PerfLogs\Admin\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  2d3012d62421ae54f37319c90a265b33

                                                                                                                                                  SHA1

                                                                                                                                                  fe165777eed3206cd8bd590c2b750d8841186391

                                                                                                                                                  SHA256

                                                                                                                                                  4a51d82c9422075d5c99695f7dac45611cb3ab6bc17b66db273bc7413f037b6a

                                                                                                                                                  SHA512

                                                                                                                                                  4620c90f6a67caf727b8e2827e6cc5951171264bedd36a87e7c080487918c1d1ec7c2b7c8d5f1441d286e60c030a44f0c7e82419192a3c57e2e9f1e232f3b6fd

                                                                                                                                                • \PerfLogs\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  30f3f0662f594b426bc253a2a63472f3

                                                                                                                                                  SHA1

                                                                                                                                                  8dca41a248e74813bf7dd405b052880bac23d998

                                                                                                                                                  SHA256

                                                                                                                                                  720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114

                                                                                                                                                  SHA512

                                                                                                                                                  7692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e

                                                                                                                                                • \PerfLogs\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  30f3f0662f594b426bc253a2a63472f3

                                                                                                                                                  SHA1

                                                                                                                                                  8dca41a248e74813bf7dd405b052880bac23d998

                                                                                                                                                  SHA256

                                                                                                                                                  720ddb51e8706a35a2a59145dc7fbeb3e58d17924e054d29b996e7d7311f0114

                                                                                                                                                  SHA512

                                                                                                                                                  7692c21aa86ff148b6a2bd51a11c6522ea9aee2f38f5cc52b36eaac8181f28a467b08643543dd4f96f2c51667c6813f8ca019a80a834d8777a81a53804ee244e

                                                                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  ca604046794847c97baab2c854f98b44

                                                                                                                                                  SHA1

                                                                                                                                                  5d0b86028f6e3adb451b48753e765117b005b84a

                                                                                                                                                  SHA256

                                                                                                                                                  59b032d9c5ade3b8a693e04cfb51f72ef43c95fb2cd24fe246428b492ddb6237

                                                                                                                                                  SHA512

                                                                                                                                                  493d4288ec53f28d4200dbd478e82c4cb178c0865f7dfc20c220635d373a336ed81029fc761a9bdd5d54da42d7051a13168bf04c2bbb5685e927c009a27c5e1d

                                                                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  ca604046794847c97baab2c854f98b44

                                                                                                                                                  SHA1

                                                                                                                                                  5d0b86028f6e3adb451b48753e765117b005b84a

                                                                                                                                                  SHA256

                                                                                                                                                  59b032d9c5ade3b8a693e04cfb51f72ef43c95fb2cd24fe246428b492ddb6237

                                                                                                                                                  SHA512

                                                                                                                                                  493d4288ec53f28d4200dbd478e82c4cb178c0865f7dfc20c220635d373a336ed81029fc761a9bdd5d54da42d7051a13168bf04c2bbb5685e927c009a27c5e1d

                                                                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  529638016d16cc16bea4145c5fd8a59f

                                                                                                                                                  SHA1

                                                                                                                                                  b42011d3e717049a9825c1d2141ef2dd20dc4e77

                                                                                                                                                  SHA256

                                                                                                                                                  dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101

                                                                                                                                                  SHA512

                                                                                                                                                  38a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148

                                                                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  529638016d16cc16bea4145c5fd8a59f

                                                                                                                                                  SHA1

                                                                                                                                                  b42011d3e717049a9825c1d2141ef2dd20dc4e77

                                                                                                                                                  SHA256

                                                                                                                                                  dcdce68260366886e2e39a89888883f7369b0e26077ac248bc25134fae727101

                                                                                                                                                  SHA512

                                                                                                                                                  38a84b59c595c9acaa0b4ffcef7184eeef4ea89e99ce58c308c8e5201985fa77ecc68ffb0ae5386b4b25be88ba4a283d942e700b91a958e33528d982680e9148

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf7cc94b0772847719b0f4a9b149418f

                                                                                                                                                  SHA1

                                                                                                                                                  ac5ab6aa0ebaaf8a6e6c57492d1e6223541803f0

                                                                                                                                                  SHA256

                                                                                                                                                  33f66dc8635701903497e9d01211367be5d4eafde77db7f69f4ca154fa79efc8

                                                                                                                                                  SHA512

                                                                                                                                                  aeecdc1faf8a744f3271f565777b1aa46235df8874f0279e237688a8a0ddff541278e1820247ecc26fd7b86ca980c8d4cd4dc619309ddee724bb986b473877cb

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf7cc94b0772847719b0f4a9b149418f

                                                                                                                                                  SHA1

                                                                                                                                                  ac5ab6aa0ebaaf8a6e6c57492d1e6223541803f0

                                                                                                                                                  SHA256

                                                                                                                                                  33f66dc8635701903497e9d01211367be5d4eafde77db7f69f4ca154fa79efc8

                                                                                                                                                  SHA512

                                                                                                                                                  aeecdc1faf8a744f3271f565777b1aa46235df8874f0279e237688a8a0ddff541278e1820247ecc26fd7b86ca980c8d4cd4dc619309ddee724bb986b473877cb

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  322c8beed2a0e6b561977231813b822a

                                                                                                                                                  SHA1

                                                                                                                                                  debe222c958cf11c6c0612e6c0af39f934d909bc

                                                                                                                                                  SHA256

                                                                                                                                                  0698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536

                                                                                                                                                  SHA512

                                                                                                                                                  73ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  322c8beed2a0e6b561977231813b822a

                                                                                                                                                  SHA1

                                                                                                                                                  debe222c958cf11c6c0612e6c0af39f934d909bc

                                                                                                                                                  SHA256

                                                                                                                                                  0698074f3a25ef3f5539d5c329722dfb4f9095d0581b83081ebcdccbd9dfd536

                                                                                                                                                  SHA512

                                                                                                                                                  73ec267205f3c6c5cd2b409842aba836f26fa3922be613862b456b645468112c04c9d44e3300daa415a86c61b51f3e4bf483626d9b8a8d2bd6f69ff6bef9f09b

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  17e00708f76dc190fdc841300664a92a

                                                                                                                                                  SHA1

                                                                                                                                                  0730165d9fce716eb7748e88db65506d98cbf0ce

                                                                                                                                                  SHA256

                                                                                                                                                  10085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a

                                                                                                                                                  SHA512

                                                                                                                                                  538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  17e00708f76dc190fdc841300664a92a

                                                                                                                                                  SHA1

                                                                                                                                                  0730165d9fce716eb7748e88db65506d98cbf0ce

                                                                                                                                                  SHA256

                                                                                                                                                  10085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a

                                                                                                                                                  SHA512

                                                                                                                                                  538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  d26661aa2a4636e1d31a4a22aebe557e

                                                                                                                                                  SHA1

                                                                                                                                                  4a8f128b6f03085ed001ffbb010b1555c59c7cfa

                                                                                                                                                  SHA256

                                                                                                                                                  c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85

                                                                                                                                                  SHA512

                                                                                                                                                  3830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  d26661aa2a4636e1d31a4a22aebe557e

                                                                                                                                                  SHA1

                                                                                                                                                  4a8f128b6f03085ed001ffbb010b1555c59c7cfa

                                                                                                                                                  SHA256

                                                                                                                                                  c3d441e3bf954a295c250f853149b0eb122e2bd8a99017d593b8c95243479d85

                                                                                                                                                  SHA512

                                                                                                                                                  3830ae2d5d51c3f136771b7eafa81db5c1944f72cb121d16d86c426b8c9a286ad119caae3a7268549790419de8bfd01fabb583f563d462cfaa01868c71cf7185

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  17e00708f76dc190fdc841300664a92a

                                                                                                                                                  SHA1

                                                                                                                                                  0730165d9fce716eb7748e88db65506d98cbf0ce

                                                                                                                                                  SHA256

                                                                                                                                                  10085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a

                                                                                                                                                  SHA512

                                                                                                                                                  538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  17e00708f76dc190fdc841300664a92a

                                                                                                                                                  SHA1

                                                                                                                                                  0730165d9fce716eb7748e88db65506d98cbf0ce

                                                                                                                                                  SHA256

                                                                                                                                                  10085a3831d2c8ecb70bd68615ea501ec2d4714c7ef2f19a7c52b9e43f30786a

                                                                                                                                                  SHA512

                                                                                                                                                  538637537e4cc9b28a70c1191af83300fe42d842e153c9461f03093f2fb2bf06d02ee3cedfcf071ffa1accab15e592ed611c7be48055b4f884654f551ddbd219

                                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  7fd0bc21a33a9a35435bd1560fac65c0

                                                                                                                                                  SHA1

                                                                                                                                                  693ec4febb94683ee128634688ab5ed23cb5ac40

                                                                                                                                                  SHA256

                                                                                                                                                  e64b567e8e3a0963747cd6b354ba3dbdeb848849a55f29fae19024d36a8b3589

                                                                                                                                                  SHA512

                                                                                                                                                  4e7d4b38943616c813dd75d9f3b73e49dec1c22ccdd5e87e8db3cc0b940a52cec816dfd92e2bb7a05b61050dfa934f0262e116d5ac08bb1df2d37a95b9b6e8f1

                                                                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf168746d3f31d8a5736a9dca03d615a

                                                                                                                                                  SHA1

                                                                                                                                                  997231c8af098669857d202877e0693c997983eb

                                                                                                                                                  SHA256

                                                                                                                                                  c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f

                                                                                                                                                  SHA512

                                                                                                                                                  3783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0

                                                                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  bf168746d3f31d8a5736a9dca03d615a

                                                                                                                                                  SHA1

                                                                                                                                                  997231c8af098669857d202877e0693c997983eb

                                                                                                                                                  SHA256

                                                                                                                                                  c6cf954689b8476679d84f37d1b9f621c2bffe5385c171eb6e628363fbdf5e3f

                                                                                                                                                  SHA512

                                                                                                                                                  3783a79e96842f4019ec3e93b6b96972d6705bc27b464a93a342e4b4da2ba6e47f14b0de0fd7e799e749add035cf0badd9724cccdb4db36e10c25fc0ce7730f0

                                                                                                                                                • \Program Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  cf548b065e5d8458d6587c84967b00f0

                                                                                                                                                  SHA1

                                                                                                                                                  735fa5e2898d68fd8a8e2a5d31f41cd5305956ec

                                                                                                                                                  SHA256

                                                                                                                                                  1d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144

                                                                                                                                                  SHA512

                                                                                                                                                  615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1

                                                                                                                                                • \Program Files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  cf548b065e5d8458d6587c84967b00f0

                                                                                                                                                  SHA1

                                                                                                                                                  735fa5e2898d68fd8a8e2a5d31f41cd5305956ec

                                                                                                                                                  SHA256

                                                                                                                                                  1d22f4e27bedd5aa40ec48bb5c0872864d714fecbaa9e4439e17972152183144

                                                                                                                                                  SHA512

                                                                                                                                                  615ed4c24c811f42ea9964976ffc92234969a1f4f7e1cc8d4bd7dc663d32d1b6440f327310f9f2afb830ad62bfaf2cc624c53cde9b56b73ff0198358b8de7cb1

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\2910522919\System Restore.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  08f59b266367e8fb8e0f2fa79f406d9a

                                                                                                                                                  SHA1

                                                                                                                                                  c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa

                                                                                                                                                  SHA256

                                                                                                                                                  89c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93

                                                                                                                                                  SHA512

                                                                                                                                                  a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  08f59b266367e8fb8e0f2fa79f406d9a

                                                                                                                                                  SHA1

                                                                                                                                                  c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa

                                                                                                                                                  SHA256

                                                                                                                                                  89c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93

                                                                                                                                                  SHA512

                                                                                                                                                  a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  46d5a56ac778b430d9158266c27e0e3b

                                                                                                                                                  SHA1

                                                                                                                                                  65aa9c3845f9521428143622f565a4fddc4d834b

                                                                                                                                                  SHA256

                                                                                                                                                  ceb8a43503aa37d5c95f58500f05f645a79403695cc14b02e713a343381de73b

                                                                                                                                                  SHA512

                                                                                                                                                  9cd89fedf1500086bb583471daf1973963d8c89a741e7279fd4d4ec89dfc862c1113d049e5751d6f51db476367fc993eff1e47fb5e57c29b36a81233ce6ae80a

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  08f59b266367e8fb8e0f2fa79f406d9a

                                                                                                                                                  SHA1

                                                                                                                                                  c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa

                                                                                                                                                  SHA256

                                                                                                                                                  89c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93

                                                                                                                                                  SHA512

                                                                                                                                                  a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3

                                                                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                                  Filesize

                                                                                                                                                  72KB

                                                                                                                                                  MD5

                                                                                                                                                  08f59b266367e8fb8e0f2fa79f406d9a

                                                                                                                                                  SHA1

                                                                                                                                                  c42bbcbcdf4f2c07b5c8ead13d34900025bb31aa

                                                                                                                                                  SHA256

                                                                                                                                                  89c84cdef269504a423131d4398bd20e2dd8ef7b7201373fa5a1fea9eac39e93

                                                                                                                                                  SHA512

                                                                                                                                                  a30e55eda0077cca00a6927d692638f204d418b952e8e1d74566f0450fed85639ef99580903b3ba30013c5cde13fc70faa6ed116e5e2ecf27ddb4096dbfe1eb3

                                                                                                                                                • memory/1976-111-0x00000000762B1000-0x00000000762B3000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  8KB