Overview

overview

10

Static

static

77b03adaa9...ae.exe

windows7-x64

10

77b03adaa9...ae.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    88s
  • max time network
    48s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    06/11/2022, 12:33

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    77b03adaa9882f45446e764aae0fddf107552d15fee013881336237833fc61ae.exe

  • Size

    72KB

  • MD5

    0e9b6c08c886051879b6d8d735c02471

  • SHA1

    82248c4491c2e834026c16b3d10f88cd7e0a84dd

  • SHA256

    77b03adaa9882f45446e764aae0fddf107552d15fee013881336237833fc61ae

  • SHA512

    81c9ca5b0a8806578c9bc15800de84d9bb8ccfccb1e7e917e56b3d46ae3bfeadd424346dee07a4891e4c6ef1526571edf26e732addc866370f7465658095fc72

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2e:ipQNwC3BEddsEqOt/hyJF+x3BEJwRri

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\77b03adaa9882f45446e764aae0fddf107552d15fee013881336237833fc61ae.exe
    "C:\Users\Admin\AppData\Local\Temp\77b03adaa9882f45446e764aae0fddf107552d15fee013881336237833fc61ae.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:960
    • C:\Users\Admin\AppData\Local\Temp\1961103218\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1961103218\backup.exe C:\Users\Admin\AppData\Local\Temp\1961103218\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1236
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:888
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1676
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1348
        • C:\Program Files\System Restore.exe
          "C:\Program Files\System Restore.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:588
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:384
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:884
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1928
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              PID:1588
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1416
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1768
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1544
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1720
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:428
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1804
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1980
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:912
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2040
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1916
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1932
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1976
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1612
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1288
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:640
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:384
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                      PID:1416
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                      9⤵
                        PID:992
                      • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                        9⤵
                          PID:1952
                      • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1544
                      • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1040
                      • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                        8⤵
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1216
                      • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                        8⤵
                          PID:1552
                        • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                          8⤵
                            PID:1368
                          • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe
                            "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                            8⤵
                              PID:840
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:736
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                              8⤵
                                PID:612
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                                8⤵
                                  PID:640
                                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                                  8⤵
                                    PID:1640
                                • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                  7⤵
                                    PID:924
                                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                                      8⤵
                                        PID:1112
                                    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                      7⤵
                                        PID:1620
                                      • C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                        7⤵
                                          PID:2004
                                        • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                          7⤵
                                            PID:428
                                          • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                            7⤵
                                              PID:1156
                                          • C:\Program Files\Common Files\Services\backup.exe
                                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                            6⤵
                                            • Executes dropped EXE
                                            PID:1204
                                          • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                            "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                            6⤵
                                              PID:948
                                            • C:\Program Files\Common Files\System\backup.exe
                                              "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                              6⤵
                                                PID:1940
                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                  7⤵
                                                    PID:360
                                                  • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                    7⤵
                                                      PID:1256
                                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                      7⤵
                                                        PID:1784
                                                  • C:\Program Files\DVD Maker\backup.exe
                                                    "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:560
                                                    • C:\Program Files\DVD Maker\de-DE\data.exe
                                                      "C:\Program Files\DVD Maker\de-DE\data.exe" C:\Program Files\DVD Maker\de-DE\
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1540
                                                    • C:\Program Files\DVD Maker\en-US\backup.exe
                                                      "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                      6⤵
                                                        PID:816
                                                      • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                        "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                        6⤵
                                                          PID:1036
                                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                          6⤵
                                                            PID:1752
                                                          • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                            "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                            6⤵
                                                              PID:1120
                                                          • C:\Program Files\Google\backup.exe
                                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                            5⤵
                                                              PID:1008
                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                              5⤵
                                                                PID:1172
                                                              • C:\Program Files\Java\backup.exe
                                                                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                5⤵
                                                                  PID:1608
                                                                • C:\Program Files\Microsoft Games\backup.exe
                                                                  "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                  5⤵
                                                                    PID:2008
                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                    5⤵
                                                                      PID:1832
                                                                  • C:\Program Files (x86)\backup.exe
                                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                    4⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • System policy modification
                                                                    PID:1900
                                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                      5⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:1832
                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:944
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1640
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Loads dropped DLL
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:2024
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:736
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1892
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1552
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Loads dropped DLL
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1716
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\data.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:640
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:800
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1068
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1492
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:536
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1500
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1016
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
                                                                                10⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:1760
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1568
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
                                                                                10⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:1728
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                  11⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:1348
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\update.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
                                                                              9⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1888
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
                                                                                10⤵
                                                                                • Executes dropped EXE
                                                                                PID:884
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
                                                                              9⤵
                                                                                PID:1412
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
                                                                                  10⤵
                                                                                    PID:1344
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                8⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:1708
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
                                                                                  9⤵
                                                                                    PID:1220
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                  8⤵
                                                                                    PID:1760
                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                    8⤵
                                                                                      PID:1544
                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe
                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Program Files directory
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    • System policy modification
                                                                                    PID:1984
                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                      8⤵
                                                                                        PID:1084
                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                        8⤵
                                                                                          PID:1636
                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
                                                                                          8⤵
                                                                                            PID:1432
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
                                                                                            8⤵
                                                                                              PID:1520
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
                                                                                              8⤵
                                                                                                PID:828
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                              7⤵
                                                                                                PID:1336
                                                                                          • C:\Program Files (x86)\Common Files\update.exe
                                                                                            "C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\
                                                                                            5⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:1892
                                                                                            • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                              6⤵
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:536
                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                7⤵
                                                                                                  PID:268
                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                  7⤵
                                                                                                    PID:1804
                                                                                                • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                  6⤵
                                                                                                    PID:1644
                                                                                                    • C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\
                                                                                                      7⤵
                                                                                                        PID:1580
                                                                                                        • C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\
                                                                                                          8⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • System policy modification
                                                                                                          PID:384
                                                                                                    • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                      "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                      6⤵
                                                                                                        PID:832
                                                                                                      • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                        6⤵
                                                                                                          PID:604
                                                                                                        • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                          6⤵
                                                                                                            PID:696
                                                                                                        • C:\Program Files (x86)\Google\backup.exe
                                                                                                          "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                          5⤵
                                                                                                            PID:1016
                                                                                                            • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                              "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                              6⤵
                                                                                                                PID:1388
                                                                                                              • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                                "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                                6⤵
                                                                                                                  PID:2028
                                                                                                                • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                                  "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                                  6⤵
                                                                                                                    PID:1676
                                                                                                                • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                  5⤵
                                                                                                                    PID:1572
                                                                                                                  • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                    5⤵
                                                                                                                      PID:1932
                                                                                                                    • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                      5⤵
                                                                                                                        PID:1292
                                                                                                                    • C:\Users\backup.exe
                                                                                                                      C:\Users\backup.exe C:\Users\
                                                                                                                      4⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:468
                                                                                                                    • C:\Windows\backup.exe
                                                                                                                      C:\Windows\backup.exe C:\Windows\
                                                                                                                      4⤵
                                                                                                                        PID:1188
                                                                                                                        • C:\Windows\addins\backup.exe
                                                                                                                          C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                          5⤵
                                                                                                                            PID:520
                                                                                                                          • C:\Windows\AppCompat\backup.exe
                                                                                                                            C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                            5⤵
                                                                                                                              PID:1912
                                                                                                                            • C:\Windows\AppPatch\backup.exe
                                                                                                                              C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                              5⤵
                                                                                                                                PID:1964
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                          2⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:1208
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                          2⤵
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          PID:844
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                          2⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          • System policy modification
                                                                                                                          PID:2036
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                          2⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          • System policy modification
                                                                                                                          PID:648
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                          2⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          • System policy modification
                                                                                                                          PID:428
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                          2⤵
                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                          • System policy modification
                                                                                                                          PID:800

                                                                                                                      Network

                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                            Replay Monitor

                                                                                                                            Loading Replay Monitor...

                                                                                                                            Downloads

                                                                                                                            • C:\PerfLogs\Admin\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              292a3268d9d0f5c73d5183407f50c184

                                                                                                                              SHA1

                                                                                                                              2d26a22547b7874021a482cb785c37be91418078

                                                                                                                              SHA256

                                                                                                                              bf8c24c31a743d08b977372edd55740e6de3709c9ad09603b6b1aa1965a72f74

                                                                                                                              SHA512

                                                                                                                              0c07cfc76e52e767180c27af8663417460b57c21f7f655e869dfc84ffd04dc8df22305c9ee7197032fe46f551cc377fc659980aaa33004b28d145866a431cca5

                                                                                                                              Download Submit

                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              5b03777dd30ad7ab50e087cb072a5213

                                                                                                                              SHA1

                                                                                                                              7c7af13527801b758c9a8f84723eeb06d4b35b37

                                                                                                                              SHA256

                                                                                                                              784c2f8a8231998e9b76dee61f36bd7cb1fc15fd13fc3e547dacaca12f0a81a7

                                                                                                                              SHA512

                                                                                                                              005562e148275d13cb541a864b761dd68dbb7b7ed44d6aa3a6a2cb8f972b9edc5ebd82dbade04a177b2870dc02661b9f24859f6fb3844b9ad4199c4e0908adb1

                                                                                                                              Download Submit

                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              5b03777dd30ad7ab50e087cb072a5213

                                                                                                                              SHA1

                                                                                                                              7c7af13527801b758c9a8f84723eeb06d4b35b37

                                                                                                                              SHA256

                                                                                                                              784c2f8a8231998e9b76dee61f36bd7cb1fc15fd13fc3e547dacaca12f0a81a7

                                                                                                                              SHA512

                                                                                                                              005562e148275d13cb541a864b761dd68dbb7b7ed44d6aa3a6a2cb8f972b9edc5ebd82dbade04a177b2870dc02661b9f24859f6fb3844b9ad4199c4e0908adb1

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              d6be7cbde5ad7db647c509293a8cf2a1

                                                                                                                              SHA1

                                                                                                                              f0350bdb0b1fd5097a717d635bd23346f0bea245

                                                                                                                              SHA256

                                                                                                                              a51044dace0ebe47750e90227707b5ea4df2fdf524cdec147344fecd88261de2

                                                                                                                              SHA512

                                                                                                                              f16c62e0e27b7e008fb58846d5668fad9be8f6d3ff473ecd0c12cd350a91a2b0db473b3d472ec3faca8884627c8132f12056c22b6862f573e954e6575dcfdc6f

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              e813428d04d0259cd97e22bf4b38d59d

                                                                                                                              SHA1

                                                                                                                              e9df4e8f6b2d2d731b4d75db58164fb5753c2703

                                                                                                                              SHA256

                                                                                                                              12408b42d0c3df3ccda20fcaea54c4f8d1e03c1982c87e6d122968c6729117ab

                                                                                                                              SHA512

                                                                                                                              f99266d4f1fceeaabc0adcf358bec35a7b3ab959082f1784f6d6b159bdc153c5eb940836743e3acbac37a2a643f6a6eba956e33c521658a024026b6b8dbce632

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              e813428d04d0259cd97e22bf4b38d59d

                                                                                                                              SHA1

                                                                                                                              e9df4e8f6b2d2d731b4d75db58164fb5753c2703

                                                                                                                              SHA256

                                                                                                                              12408b42d0c3df3ccda20fcaea54c4f8d1e03c1982c87e6d122968c6729117ab

                                                                                                                              SHA512

                                                                                                                              f99266d4f1fceeaabc0adcf358bec35a7b3ab959082f1784f6d6b159bdc153c5eb940836743e3acbac37a2a643f6a6eba956e33c521658a024026b6b8dbce632

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files (x86)\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              984454dd53477d8b752ff9566e6d69af

                                                                                                                              SHA1

                                                                                                                              19958865a99b38ed9f4ba6f91ac0ce2aa2eaf1ce

                                                                                                                              SHA256

                                                                                                                              aa16acde1f56966cb709952804744c91033597c561f25ecc57d57299fe74cdef

                                                                                                                              SHA512

                                                                                                                              e82a6edc0f2bfcc5ef0d1584d8976ebccb3c3aaf43ba5ba544b4dbc3316f25ac9edfcd4c41dac0d7e463ec9036648077fc347a52e0de2c78dbbb4dd58732bcf0

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files (x86)\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              984454dd53477d8b752ff9566e6d69af

                                                                                                                              SHA1

                                                                                                                              19958865a99b38ed9f4ba6f91ac0ce2aa2eaf1ce

                                                                                                                              SHA256

                                                                                                                              aa16acde1f56966cb709952804744c91033597c561f25ecc57d57299fe74cdef

                                                                                                                              SHA512

                                                                                                                              e82a6edc0f2bfcc5ef0d1584d8976ebccb3c3aaf43ba5ba544b4dbc3316f25ac9edfcd4c41dac0d7e463ec9036648077fc347a52e0de2c78dbbb4dd58732bcf0

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              09e8b20e2cf4eeee0ed602ea882baadc

                                                                                                                              SHA1

                                                                                                                              32ccaade9b26921e0558ed3988f49b6ae2778a2b

                                                                                                                              SHA256

                                                                                                                              77773bfbf446484966f0c95a62209ade1efc17ed16b72caa028608bf3e01cffd

                                                                                                                              SHA512

                                                                                                                              1159955a6afed6c0e3ccb42ffae1360150381e1009c7e8bd9b52b0737c113c0685b5e3a583dd7f58ac8dd220d87e591e0a6310f8faa4ba98cfe32f8ec9b5fde7

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              7994f7192287cd39a6499c781400648b

                                                                                                                              SHA1

                                                                                                                              0ae8fdccd4a7f1db3cf5ab58c6172138d4a5117d

                                                                                                                              SHA256

                                                                                                                              065f5c782d9b44686a3099f84b4f59de041c6bcb857d1fb96c3487ee478daeac

                                                                                                                              SHA512

                                                                                                                              1304bb307b84f5844a083b16933a01ce04d7a9c56762c7bdc83227b321777347c5c5d1c6784f9c6354699ca271932529c2d68cb8c3e71ae02cb145835d0a221d

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              461dfd57d2b67e1b05f60ede61ca27ac

                                                                                                                              SHA1

                                                                                                                              8fc1aab457f3b0c73566547f302a8b7db3db379d

                                                                                                                              SHA256

                                                                                                                              2eac040a3b8407f6a5cfbb9e3b7c6e317ab5ae9ec059fea9562f8807b81a2b32

                                                                                                                              SHA512

                                                                                                                              6db44d9754abadb74bf7c6ce663d46dcb373386c8832aa4d3a122ca00d577125553d20f16efab3111ebc9c95caee8a5d00ce46730371bb84f0c2d0489937d8e1

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              461dfd57d2b67e1b05f60ede61ca27ac

                                                                                                                              SHA1

                                                                                                                              8fc1aab457f3b0c73566547f302a8b7db3db379d

                                                                                                                              SHA256

                                                                                                                              2eac040a3b8407f6a5cfbb9e3b7c6e317ab5ae9ec059fea9562f8807b81a2b32

                                                                                                                              SHA512

                                                                                                                              6db44d9754abadb74bf7c6ce663d46dcb373386c8832aa4d3a122ca00d577125553d20f16efab3111ebc9c95caee8a5d00ce46730371bb84f0c2d0489937d8e1

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\System Restore.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              2aab55947e48f1292cc3abf239c70608

                                                                                                                              SHA1

                                                                                                                              ad2d415e75e7496374c2b8502d1f067b9b3c3c72

                                                                                                                              SHA256

                                                                                                                              8f8570b4f565969023964ee1658dae949d7c9bc78863f35e6373c23f875c0127

                                                                                                                              SHA512

                                                                                                                              36a7d58b238f8f92b87718e4bbc6c12bb299ac987bc1113ebce5989ee0c3691975da66d0a6fa6e5e7f545c5d5d1bae8bc2b985456c3fd7ff3d63c4e97cae9033

                                                                                                                              Download Submit

                                                                                                                            • C:\Program Files\System Restore.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              2aab55947e48f1292cc3abf239c70608

                                                                                                                              SHA1

                                                                                                                              ad2d415e75e7496374c2b8502d1f067b9b3c3c72

                                                                                                                              SHA256

                                                                                                                              8f8570b4f565969023964ee1658dae949d7c9bc78863f35e6373c23f875c0127

                                                                                                                              SHA512

                                                                                                                              36a7d58b238f8f92b87718e4bbc6c12bb299ac987bc1113ebce5989ee0c3691975da66d0a6fa6e5e7f545c5d5d1bae8bc2b985456c3fd7ff3d63c4e97cae9033

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1961103218\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              72b63584cd8d0a1f1c4234ec4864bc46

                                                                                                                              SHA1

                                                                                                                              638913836e91daa96563aa31559f95bd276cdf3f

                                                                                                                              SHA256

                                                                                                                              8a0e2ae8c230104247732e0c1e9c80df6ed90d14c8d0e6ca5063e13ef6c4a072

                                                                                                                              SHA512

                                                                                                                              f6284fa4893e4c78f211f980f90cb8f98e7f990b797c8f5b927b4329ba7c7365da8b7eddd25a4ccc922e20b47899fdb73df1dc6b3c1177496c72e177d227730e

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\1961103218\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              72b63584cd8d0a1f1c4234ec4864bc46

                                                                                                                              SHA1

                                                                                                                              638913836e91daa96563aa31559f95bd276cdf3f

                                                                                                                              SHA256

                                                                                                                              8a0e2ae8c230104247732e0c1e9c80df6ed90d14c8d0e6ca5063e13ef6c4a072

                                                                                                                              SHA512

                                                                                                                              f6284fa4893e4c78f211f980f90cb8f98e7f990b797c8f5b927b4329ba7c7365da8b7eddd25a4ccc922e20b47899fdb73df1dc6b3c1177496c72e177d227730e

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              14904e77f2a94e1753378a2fd7ddfbdc

                                                                                                                              SHA1

                                                                                                                              85ba157b0e244e7d769294dd3e77a1574adbed03

                                                                                                                              SHA256

                                                                                                                              e0feafc1b78574447c58eb0d2fb916379cc844f028fbfd5f66d068a793e8e9d6

                                                                                                                              SHA512

                                                                                                                              0c0f12354bfe9258a81a829d40dea0eaae9b4aaf24b30ad965397a48e46f69ae15ebca9a8435fdc3651e6791e0a43ca73e9a34589d5796ad9c6c6ffbea4c984a

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              14904e77f2a94e1753378a2fd7ddfbdc

                                                                                                                              SHA1

                                                                                                                              85ba157b0e244e7d769294dd3e77a1574adbed03

                                                                                                                              SHA256

                                                                                                                              e0feafc1b78574447c58eb0d2fb916379cc844f028fbfd5f66d068a793e8e9d6

                                                                                                                              SHA512

                                                                                                                              0c0f12354bfe9258a81a829d40dea0eaae9b4aaf24b30ad965397a48e46f69ae15ebca9a8435fdc3651e6791e0a43ca73e9a34589d5796ad9c6c6ffbea4c984a

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              188227405a355fe13874bfd919c5e659

                                                                                                                              SHA1

                                                                                                                              a52e4c1425c0854addc61481699451ad4b9fb255

                                                                                                                              SHA256

                                                                                                                              a1cf1c4d5c21340c05b2a79892f39034afed6e77622be710175d1a4df99d35cf

                                                                                                                              SHA512

                                                                                                                              bc967340927b4f53f6011f0c124f883cbf0b2f8467fe69413c7425408334b3f51f3060a4a0690f6da49b8ba892d1c7763aa4d1a699b69560c940a0df031a3e9d

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              277f85583d1a52b89741dd547013e848

                                                                                                                              SHA1

                                                                                                                              bb6982bb35ca31b0a615e344c1ff8d969eccabe7

                                                                                                                              SHA256

                                                                                                                              443d7be48cc9e29694fb56ced390e325d76c262bb2291e3967bb9abe3b8e65dc

                                                                                                                              SHA512

                                                                                                                              8fc0f4b58b17ae6b75e23b4e4a9901c83baa090cbd4a4cdf47f69f12121af9acf4e022a7a639b13ecdfb7f46351543212ca785b623ff4f31e1790435c11828a2

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              04dfff4418a034a5617b36cf587029c9

                                                                                                                              SHA1

                                                                                                                              f3d9a02e774ab7174affc8b8458be99f2201d465

                                                                                                                              SHA256

                                                                                                                              464dfc0d5df8c89b7465963e36c1ac393c39eb245bdc500128d1bedef614757f

                                                                                                                              SHA512

                                                                                                                              62409281019e9e755c805949dfaed83bed087b9623cfab03a7239583c62d9d224950d9ad62b2afafe8d51b525c6372663ceb540ee5d3c31e0942b8f51aa9007e

                                                                                                                              Download Submit

                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              188227405a355fe13874bfd919c5e659

                                                                                                                              SHA1

                                                                                                                              a52e4c1425c0854addc61481699451ad4b9fb255

                                                                                                                              SHA256

                                                                                                                              a1cf1c4d5c21340c05b2a79892f39034afed6e77622be710175d1a4df99d35cf

                                                                                                                              SHA512

                                                                                                                              bc967340927b4f53f6011f0c124f883cbf0b2f8467fe69413c7425408334b3f51f3060a4a0690f6da49b8ba892d1c7763aa4d1a699b69560c940a0df031a3e9d

                                                                                                                              Download Submit

                                                                                                                            • C:\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              7e8c4f72e87c7e9bd95e1b23c67c7644

                                                                                                                              SHA1

                                                                                                                              8aa4563dd92015d53eec2c3dcdb4646eebdcf686

                                                                                                                              SHA256

                                                                                                                              215ddae463903f3aaaee0dbb84c8121db109d4f0b267ec7157e5f0c6d3c03cf0

                                                                                                                              SHA512

                                                                                                                              b3d6e359b64a3534f6edabe40598a504cc2c92fe8e214200b1dc359378b206edd955a9e2aade0267725432fa276128c542b51931dac3200579c4e24b469a6e9d

                                                                                                                              Download Submit

                                                                                                                            • C:\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              7e8c4f72e87c7e9bd95e1b23c67c7644

                                                                                                                              SHA1

                                                                                                                              8aa4563dd92015d53eec2c3dcdb4646eebdcf686

                                                                                                                              SHA256

                                                                                                                              215ddae463903f3aaaee0dbb84c8121db109d4f0b267ec7157e5f0c6d3c03cf0

                                                                                                                              SHA512

                                                                                                                              b3d6e359b64a3534f6edabe40598a504cc2c92fe8e214200b1dc359378b206edd955a9e2aade0267725432fa276128c542b51931dac3200579c4e24b469a6e9d

                                                                                                                              Download Submit

                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              292a3268d9d0f5c73d5183407f50c184

                                                                                                                              SHA1

                                                                                                                              2d26a22547b7874021a482cb785c37be91418078

                                                                                                                              SHA256

                                                                                                                              bf8c24c31a743d08b977372edd55740e6de3709c9ad09603b6b1aa1965a72f74

                                                                                                                              SHA512

                                                                                                                              0c07cfc76e52e767180c27af8663417460b57c21f7f655e869dfc84ffd04dc8df22305c9ee7197032fe46f551cc377fc659980aaa33004b28d145866a431cca5

                                                                                                                              Download Submit

                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              292a3268d9d0f5c73d5183407f50c184

                                                                                                                              SHA1

                                                                                                                              2d26a22547b7874021a482cb785c37be91418078

                                                                                                                              SHA256

                                                                                                                              bf8c24c31a743d08b977372edd55740e6de3709c9ad09603b6b1aa1965a72f74

                                                                                                                              SHA512

                                                                                                                              0c07cfc76e52e767180c27af8663417460b57c21f7f655e869dfc84ffd04dc8df22305c9ee7197032fe46f551cc377fc659980aaa33004b28d145866a431cca5

                                                                                                                              Download Submit

                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              5b03777dd30ad7ab50e087cb072a5213

                                                                                                                              SHA1

                                                                                                                              7c7af13527801b758c9a8f84723eeb06d4b35b37

                                                                                                                              SHA256

                                                                                                                              784c2f8a8231998e9b76dee61f36bd7cb1fc15fd13fc3e547dacaca12f0a81a7

                                                                                                                              SHA512

                                                                                                                              005562e148275d13cb541a864b761dd68dbb7b7ed44d6aa3a6a2cb8f972b9edc5ebd82dbade04a177b2870dc02661b9f24859f6fb3844b9ad4199c4e0908adb1

                                                                                                                              Download Submit

                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              5b03777dd30ad7ab50e087cb072a5213

                                                                                                                              SHA1

                                                                                                                              7c7af13527801b758c9a8f84723eeb06d4b35b37

                                                                                                                              SHA256

                                                                                                                              784c2f8a8231998e9b76dee61f36bd7cb1fc15fd13fc3e547dacaca12f0a81a7

                                                                                                                              SHA512

                                                                                                                              005562e148275d13cb541a864b761dd68dbb7b7ed44d6aa3a6a2cb8f972b9edc5ebd82dbade04a177b2870dc02661b9f24859f6fb3844b9ad4199c4e0908adb1

                                                                                                                              Download Submit

                                                                                                                            • \Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              d6be7cbde5ad7db647c509293a8cf2a1

                                                                                                                              SHA1

                                                                                                                              f0350bdb0b1fd5097a717d635bd23346f0bea245

                                                                                                                              SHA256

                                                                                                                              a51044dace0ebe47750e90227707b5ea4df2fdf524cdec147344fecd88261de2

                                                                                                                              SHA512

                                                                                                                              f16c62e0e27b7e008fb58846d5668fad9be8f6d3ff473ecd0c12cd350a91a2b0db473b3d472ec3faca8884627c8132f12056c22b6862f573e954e6575dcfdc6f

                                                                                                                              Download Submit

                                                                                                                            • \Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              d6be7cbde5ad7db647c509293a8cf2a1

                                                                                                                              SHA1

                                                                                                                              f0350bdb0b1fd5097a717d635bd23346f0bea245

                                                                                                                              SHA256

                                                                                                                              a51044dace0ebe47750e90227707b5ea4df2fdf524cdec147344fecd88261de2

                                                                                                                              SHA512

                                                                                                                              f16c62e0e27b7e008fb58846d5668fad9be8f6d3ff473ecd0c12cd350a91a2b0db473b3d472ec3faca8884627c8132f12056c22b6862f573e954e6575dcfdc6f

                                                                                                                              Download Submit

                                                                                                                            • \Program Files (x86)\Adobe\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              e813428d04d0259cd97e22bf4b38d59d

                                                                                                                              SHA1

                                                                                                                              e9df4e8f6b2d2d731b4d75db58164fb5753c2703

                                                                                                                              SHA256

                                                                                                                              12408b42d0c3df3ccda20fcaea54c4f8d1e03c1982c87e6d122968c6729117ab

                                                                                                                              SHA512

                                                                                                                              f99266d4f1fceeaabc0adcf358bec35a7b3ab959082f1784f6d6b159bdc153c5eb940836743e3acbac37a2a643f6a6eba956e33c521658a024026b6b8dbce632

                                                                                                                              Download Submit

                                                                                                                            • \Program Files (x86)\Adobe\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              e813428d04d0259cd97e22bf4b38d59d

                                                                                                                              SHA1

                                                                                                                              e9df4e8f6b2d2d731b4d75db58164fb5753c2703

                                                                                                                              SHA256

                                                                                                                              12408b42d0c3df3ccda20fcaea54c4f8d1e03c1982c87e6d122968c6729117ab

                                                                                                                              SHA512

                                                                                                                              f99266d4f1fceeaabc0adcf358bec35a7b3ab959082f1784f6d6b159bdc153c5eb940836743e3acbac37a2a643f6a6eba956e33c521658a024026b6b8dbce632

                                                                                                                              Download Submit

                                                                                                                            • \Program Files (x86)\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              984454dd53477d8b752ff9566e6d69af

                                                                                                                              SHA1

                                                                                                                              19958865a99b38ed9f4ba6f91ac0ce2aa2eaf1ce

                                                                                                                              SHA256

                                                                                                                              aa16acde1f56966cb709952804744c91033597c561f25ecc57d57299fe74cdef

                                                                                                                              SHA512

                                                                                                                              e82a6edc0f2bfcc5ef0d1584d8976ebccb3c3aaf43ba5ba544b4dbc3316f25ac9edfcd4c41dac0d7e463ec9036648077fc347a52e0de2c78dbbb4dd58732bcf0

                                                                                                                              Download Submit

                                                                                                                            • \Program Files (x86)\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              984454dd53477d8b752ff9566e6d69af

                                                                                                                              SHA1

                                                                                                                              19958865a99b38ed9f4ba6f91ac0ce2aa2eaf1ce

                                                                                                                              SHA256

                                                                                                                              aa16acde1f56966cb709952804744c91033597c561f25ecc57d57299fe74cdef

                                                                                                                              SHA512

                                                                                                                              e82a6edc0f2bfcc5ef0d1584d8976ebccb3c3aaf43ba5ba544b4dbc3316f25ac9edfcd4c41dac0d7e463ec9036648077fc347a52e0de2c78dbbb4dd58732bcf0

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              09e8b20e2cf4eeee0ed602ea882baadc

                                                                                                                              SHA1

                                                                                                                              32ccaade9b26921e0558ed3988f49b6ae2778a2b

                                                                                                                              SHA256

                                                                                                                              77773bfbf446484966f0c95a62209ade1efc17ed16b72caa028608bf3e01cffd

                                                                                                                              SHA512

                                                                                                                              1159955a6afed6c0e3ccb42ffae1360150381e1009c7e8bd9b52b0737c113c0685b5e3a583dd7f58ac8dd220d87e591e0a6310f8faa4ba98cfe32f8ec9b5fde7

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              09e8b20e2cf4eeee0ed602ea882baadc

                                                                                                                              SHA1

                                                                                                                              32ccaade9b26921e0558ed3988f49b6ae2778a2b

                                                                                                                              SHA256

                                                                                                                              77773bfbf446484966f0c95a62209ade1efc17ed16b72caa028608bf3e01cffd

                                                                                                                              SHA512

                                                                                                                              1159955a6afed6c0e3ccb42ffae1360150381e1009c7e8bd9b52b0737c113c0685b5e3a583dd7f58ac8dd220d87e591e0a6310f8faa4ba98cfe32f8ec9b5fde7

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              7994f7192287cd39a6499c781400648b

                                                                                                                              SHA1

                                                                                                                              0ae8fdccd4a7f1db3cf5ab58c6172138d4a5117d

                                                                                                                              SHA256

                                                                                                                              065f5c782d9b44686a3099f84b4f59de041c6bcb857d1fb96c3487ee478daeac

                                                                                                                              SHA512

                                                                                                                              1304bb307b84f5844a083b16933a01ce04d7a9c56762c7bdc83227b321777347c5c5d1c6784f9c6354699ca271932529c2d68cb8c3e71ae02cb145835d0a221d

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              7994f7192287cd39a6499c781400648b

                                                                                                                              SHA1

                                                                                                                              0ae8fdccd4a7f1db3cf5ab58c6172138d4a5117d

                                                                                                                              SHA256

                                                                                                                              065f5c782d9b44686a3099f84b4f59de041c6bcb857d1fb96c3487ee478daeac

                                                                                                                              SHA512

                                                                                                                              1304bb307b84f5844a083b16933a01ce04d7a9c56762c7bdc83227b321777347c5c5d1c6784f9c6354699ca271932529c2d68cb8c3e71ae02cb145835d0a221d

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              461dfd57d2b67e1b05f60ede61ca27ac

                                                                                                                              SHA1

                                                                                                                              8fc1aab457f3b0c73566547f302a8b7db3db379d

                                                                                                                              SHA256

                                                                                                                              2eac040a3b8407f6a5cfbb9e3b7c6e317ab5ae9ec059fea9562f8807b81a2b32

                                                                                                                              SHA512

                                                                                                                              6db44d9754abadb74bf7c6ce663d46dcb373386c8832aa4d3a122ca00d577125553d20f16efab3111ebc9c95caee8a5d00ce46730371bb84f0c2d0489937d8e1

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              461dfd57d2b67e1b05f60ede61ca27ac

                                                                                                                              SHA1

                                                                                                                              8fc1aab457f3b0c73566547f302a8b7db3db379d

                                                                                                                              SHA256

                                                                                                                              2eac040a3b8407f6a5cfbb9e3b7c6e317ab5ae9ec059fea9562f8807b81a2b32

                                                                                                                              SHA512

                                                                                                                              6db44d9754abadb74bf7c6ce663d46dcb373386c8832aa4d3a122ca00d577125553d20f16efab3111ebc9c95caee8a5d00ce46730371bb84f0c2d0489937d8e1

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              f13fe8126b4c8a9385d80edd3564eb98

                                                                                                                              SHA1

                                                                                                                              c6ea8f4b9731448c0ffa5159936267400cbd8c52

                                                                                                                              SHA256

                                                                                                                              65ebd28592b10f48d0cb8173dbe148afb15ba9e2173d6740c8d856c5e6a97659

                                                                                                                              SHA512

                                                                                                                              f5c14275c40468984a62abb8372be8746cf8e156dffbc7a2d116db6021e006025b3b550f7ce9a7572276796e649b11a37de61944fba30aa3dcd6f2c92a336eda

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\System Restore.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              2aab55947e48f1292cc3abf239c70608

                                                                                                                              SHA1

                                                                                                                              ad2d415e75e7496374c2b8502d1f067b9b3c3c72

                                                                                                                              SHA256

                                                                                                                              8f8570b4f565969023964ee1658dae949d7c9bc78863f35e6373c23f875c0127

                                                                                                                              SHA512

                                                                                                                              36a7d58b238f8f92b87718e4bbc6c12bb299ac987bc1113ebce5989ee0c3691975da66d0a6fa6e5e7f545c5d5d1bae8bc2b985456c3fd7ff3d63c4e97cae9033

                                                                                                                              Download Submit

                                                                                                                            • \Program Files\System Restore.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              2aab55947e48f1292cc3abf239c70608

                                                                                                                              SHA1

                                                                                                                              ad2d415e75e7496374c2b8502d1f067b9b3c3c72

                                                                                                                              SHA256

                                                                                                                              8f8570b4f565969023964ee1658dae949d7c9bc78863f35e6373c23f875c0127

                                                                                                                              SHA512

                                                                                                                              36a7d58b238f8f92b87718e4bbc6c12bb299ac987bc1113ebce5989ee0c3691975da66d0a6fa6e5e7f545c5d5d1bae8bc2b985456c3fd7ff3d63c4e97cae9033

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\1961103218\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              72b63584cd8d0a1f1c4234ec4864bc46

                                                                                                                              SHA1

                                                                                                                              638913836e91daa96563aa31559f95bd276cdf3f

                                                                                                                              SHA256

                                                                                                                              8a0e2ae8c230104247732e0c1e9c80df6ed90d14c8d0e6ca5063e13ef6c4a072

                                                                                                                              SHA512

                                                                                                                              f6284fa4893e4c78f211f980f90cb8f98e7f990b797c8f5b927b4329ba7c7365da8b7eddd25a4ccc922e20b47899fdb73df1dc6b3c1177496c72e177d227730e

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\1961103218\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              72b63584cd8d0a1f1c4234ec4864bc46

                                                                                                                              SHA1

                                                                                                                              638913836e91daa96563aa31559f95bd276cdf3f

                                                                                                                              SHA256

                                                                                                                              8a0e2ae8c230104247732e0c1e9c80df6ed90d14c8d0e6ca5063e13ef6c4a072

                                                                                                                              SHA512

                                                                                                                              f6284fa4893e4c78f211f980f90cb8f98e7f990b797c8f5b927b4329ba7c7365da8b7eddd25a4ccc922e20b47899fdb73df1dc6b3c1177496c72e177d227730e

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              14904e77f2a94e1753378a2fd7ddfbdc

                                                                                                                              SHA1

                                                                                                                              85ba157b0e244e7d769294dd3e77a1574adbed03

                                                                                                                              SHA256

                                                                                                                              e0feafc1b78574447c58eb0d2fb916379cc844f028fbfd5f66d068a793e8e9d6

                                                                                                                              SHA512

                                                                                                                              0c0f12354bfe9258a81a829d40dea0eaae9b4aaf24b30ad965397a48e46f69ae15ebca9a8435fdc3651e6791e0a43ca73e9a34589d5796ad9c6c6ffbea4c984a

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              14904e77f2a94e1753378a2fd7ddfbdc

                                                                                                                              SHA1

                                                                                                                              85ba157b0e244e7d769294dd3e77a1574adbed03

                                                                                                                              SHA256

                                                                                                                              e0feafc1b78574447c58eb0d2fb916379cc844f028fbfd5f66d068a793e8e9d6

                                                                                                                              SHA512

                                                                                                                              0c0f12354bfe9258a81a829d40dea0eaae9b4aaf24b30ad965397a48e46f69ae15ebca9a8435fdc3651e6791e0a43ca73e9a34589d5796ad9c6c6ffbea4c984a

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              14904e77f2a94e1753378a2fd7ddfbdc

                                                                                                                              SHA1

                                                                                                                              85ba157b0e244e7d769294dd3e77a1574adbed03

                                                                                                                              SHA256

                                                                                                                              e0feafc1b78574447c58eb0d2fb916379cc844f028fbfd5f66d068a793e8e9d6

                                                                                                                              SHA512

                                                                                                                              0c0f12354bfe9258a81a829d40dea0eaae9b4aaf24b30ad965397a48e46f69ae15ebca9a8435fdc3651e6791e0a43ca73e9a34589d5796ad9c6c6ffbea4c984a

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              14904e77f2a94e1753378a2fd7ddfbdc

                                                                                                                              SHA1

                                                                                                                              85ba157b0e244e7d769294dd3e77a1574adbed03

                                                                                                                              SHA256

                                                                                                                              e0feafc1b78574447c58eb0d2fb916379cc844f028fbfd5f66d068a793e8e9d6

                                                                                                                              SHA512

                                                                                                                              0c0f12354bfe9258a81a829d40dea0eaae9b4aaf24b30ad965397a48e46f69ae15ebca9a8435fdc3651e6791e0a43ca73e9a34589d5796ad9c6c6ffbea4c984a

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              188227405a355fe13874bfd919c5e659

                                                                                                                              SHA1

                                                                                                                              a52e4c1425c0854addc61481699451ad4b9fb255

                                                                                                                              SHA256

                                                                                                                              a1cf1c4d5c21340c05b2a79892f39034afed6e77622be710175d1a4df99d35cf

                                                                                                                              SHA512

                                                                                                                              bc967340927b4f53f6011f0c124f883cbf0b2f8467fe69413c7425408334b3f51f3060a4a0690f6da49b8ba892d1c7763aa4d1a699b69560c940a0df031a3e9d

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              188227405a355fe13874bfd919c5e659

                                                                                                                              SHA1

                                                                                                                              a52e4c1425c0854addc61481699451ad4b9fb255

                                                                                                                              SHA256

                                                                                                                              a1cf1c4d5c21340c05b2a79892f39034afed6e77622be710175d1a4df99d35cf

                                                                                                                              SHA512

                                                                                                                              bc967340927b4f53f6011f0c124f883cbf0b2f8467fe69413c7425408334b3f51f3060a4a0690f6da49b8ba892d1c7763aa4d1a699b69560c940a0df031a3e9d

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              277f85583d1a52b89741dd547013e848

                                                                                                                              SHA1

                                                                                                                              bb6982bb35ca31b0a615e344c1ff8d969eccabe7

                                                                                                                              SHA256

                                                                                                                              443d7be48cc9e29694fb56ced390e325d76c262bb2291e3967bb9abe3b8e65dc

                                                                                                                              SHA512

                                                                                                                              8fc0f4b58b17ae6b75e23b4e4a9901c83baa090cbd4a4cdf47f69f12121af9acf4e022a7a639b13ecdfb7f46351543212ca785b623ff4f31e1790435c11828a2

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              277f85583d1a52b89741dd547013e848

                                                                                                                              SHA1

                                                                                                                              bb6982bb35ca31b0a615e344c1ff8d969eccabe7

                                                                                                                              SHA256

                                                                                                                              443d7be48cc9e29694fb56ced390e325d76c262bb2291e3967bb9abe3b8e65dc

                                                                                                                              SHA512

                                                                                                                              8fc0f4b58b17ae6b75e23b4e4a9901c83baa090cbd4a4cdf47f69f12121af9acf4e022a7a639b13ecdfb7f46351543212ca785b623ff4f31e1790435c11828a2

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              04dfff4418a034a5617b36cf587029c9

                                                                                                                              SHA1

                                                                                                                              f3d9a02e774ab7174affc8b8458be99f2201d465

                                                                                                                              SHA256

                                                                                                                              464dfc0d5df8c89b7465963e36c1ac393c39eb245bdc500128d1bedef614757f

                                                                                                                              SHA512

                                                                                                                              62409281019e9e755c805949dfaed83bed087b9623cfab03a7239583c62d9d224950d9ad62b2afafe8d51b525c6372663ceb540ee5d3c31e0942b8f51aa9007e

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              04dfff4418a034a5617b36cf587029c9

                                                                                                                              SHA1

                                                                                                                              f3d9a02e774ab7174affc8b8458be99f2201d465

                                                                                                                              SHA256

                                                                                                                              464dfc0d5df8c89b7465963e36c1ac393c39eb245bdc500128d1bedef614757f

                                                                                                                              SHA512

                                                                                                                              62409281019e9e755c805949dfaed83bed087b9623cfab03a7239583c62d9d224950d9ad62b2afafe8d51b525c6372663ceb540ee5d3c31e0942b8f51aa9007e

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              188227405a355fe13874bfd919c5e659

                                                                                                                              SHA1

                                                                                                                              a52e4c1425c0854addc61481699451ad4b9fb255

                                                                                                                              SHA256

                                                                                                                              a1cf1c4d5c21340c05b2a79892f39034afed6e77622be710175d1a4df99d35cf

                                                                                                                              SHA512

                                                                                                                              bc967340927b4f53f6011f0c124f883cbf0b2f8467fe69413c7425408334b3f51f3060a4a0690f6da49b8ba892d1c7763aa4d1a699b69560c940a0df031a3e9d

                                                                                                                              Download Submit

                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                              Filesize

                                                                                                                              72KB

                                                                                                                              MD5

                                                                                                                              188227405a355fe13874bfd919c5e659

                                                                                                                              SHA1

                                                                                                                              a52e4c1425c0854addc61481699451ad4b9fb255

                                                                                                                              SHA256

                                                                                                                              a1cf1c4d5c21340c05b2a79892f39034afed6e77622be710175d1a4df99d35cf

                                                                                                                              SHA512

                                                                                                                              bc967340927b4f53f6011f0c124f883cbf0b2f8467fe69413c7425408334b3f51f3060a4a0690f6da49b8ba892d1c7763aa4d1a699b69560c940a0df031a3e9d

                                                                                                                              Download Submit

                                                                                                                            • memory/960-117-0x0000000075141000-0x0000000075143000-memory.dmp

                                                                                                                              Filesize

                                                                                                                              8KB

                                                                                                                              Download