Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    152s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 00:44

General

  • Target

    2af1aa0f85a87abfb23ea955b9f56f51b3479d288961c9d37ad45380ff4c35bc.exe

  • Size

    72KB

  • MD5

    0f2b336ba2b7287e45a2fe778fe392f2

  • SHA1

    95b613fbf321be0e6a4c66b394153fc65eddee86

  • SHA256

    2af1aa0f85a87abfb23ea955b9f56f51b3479d288961c9d37ad45380ff4c35bc

  • SHA512

    754393c146be732b1850ee1fcc806a5e1a0ffed872766ac04100a33b6e48ce7307abfb18dd5ab1b431a81cdeed6692c954900656a469852035169a0f87e95cab

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2T:ipQNwC3BEddsEqOt/hyJF+x3BEJwRr/

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2af1aa0f85a87abfb23ea955b9f56f51b3479d288961c9d37ad45380ff4c35bc.exe
    "C:\Users\Admin\AppData\Local\Temp\2af1aa0f85a87abfb23ea955b9f56f51b3479d288961c9d37ad45380ff4c35bc.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1032
    • C:\Users\Admin\AppData\Local\Temp\2959381440\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2959381440\backup.exe C:\Users\Admin\AppData\Local\Temp\2959381440\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1260
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:684
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1952
          • C:\PerfLogs\Admin\update.exe
            C:\PerfLogs\Admin\update.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:572
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1380
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1060
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1976
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1564
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1644
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1888
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1996
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2044
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1744
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1252
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1784
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1316
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1712
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:272
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:632
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1348
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:996
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1140
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                      PID:880
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                      9⤵
                        PID:1428
                      • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                        9⤵
                          PID:2188
                      • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                        8⤵
                          PID:2012
                        • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                          8⤵
                            PID:2180
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:1412
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1204
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1240
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                            8⤵
                              PID:1512
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                              8⤵
                                PID:1348
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                                8⤵
                                  PID:2172
                              • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1428
                                • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                                  8⤵
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:900
                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1096
                              • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                7⤵
                                • Executes dropped EXE
                                PID:2024
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                7⤵
                                  PID:292
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\System Restore.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                  7⤵
                                    PID:2240
                                • C:\Program Files\Common Files\Services\backup.exe
                                  "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1500
                                • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                  "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1772
                                  • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                    "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1104
                                • C:\Program Files\Common Files\System\backup.exe
                                  "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1784
                                  • C:\Program Files\Common Files\System\ado\backup.exe
                                    "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                    7⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    PID:320
                                    • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                      8⤵
                                        PID:1240
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                          PID:2132
                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                        7⤵
                                          PID:2008
                                        • C:\Program Files\Common Files\System\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                          7⤵
                                            PID:2164
                                      • C:\Program Files\DVD Maker\System Restore.exe
                                        "C:\Program Files\DVD Maker\System Restore.exe" C:\Program Files\DVD Maker\
                                        5⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1620
                                        • C:\Program Files\DVD Maker\de-DE\backup.exe
                                          "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1968
                                        • C:\Program Files\DVD Maker\en-US\backup.exe
                                          "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1688
                                        • C:\Program Files\DVD Maker\es-ES\backup.exe
                                          "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1672
                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:784
                                        • C:\Program Files\DVD Maker\it-IT\backup.exe
                                          "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:756
                                        • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                          "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                          6⤵
                                            PID:364
                                          • C:\Program Files\DVD Maker\Shared\backup.exe
                                            "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                            6⤵
                                              PID:2220
                                          • C:\Program Files\Google\backup.exe
                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                            5⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Drops file in Program Files directory
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1368
                                            • C:\Program Files\Google\Chrome\backup.exe
                                              "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1832
                                              • C:\Program Files\Google\Chrome\Application\backup.exe
                                                "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:1520
                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                  8⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Drops file in Program Files directory
                                                  • System policy modification
                                                  PID:912
                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\update.exe
                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\update.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                    9⤵
                                                      PID:1576
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                      9⤵
                                                        PID:1716
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                        9⤵
                                                          PID:2196
                                                      • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                        8⤵
                                                          PID:1672
                                                        • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                          8⤵
                                                            PID:2256
                                                    • C:\Program Files\Internet Explorer\backup.exe
                                                      "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1760
                                                      • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                        "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:1616
                                                      • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                        "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                        6⤵
                                                          PID:1164
                                                        • C:\Program Files\Internet Explorer\es-ES\data.exe
                                                          "C:\Program Files\Internet Explorer\es-ES\data.exe" C:\Program Files\Internet Explorer\es-ES\
                                                          6⤵
                                                            PID:2020
                                                        • C:\Program Files\Java\backup.exe
                                                          "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                          5⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          • System policy modification
                                                          PID:1644
                                                          • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                            "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:396
                                                            • C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe
                                                              "C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\
                                                              7⤵
                                                              • Disables RegEdit via registry modification
                                                              • Suspicious use of SetWindowsHookEx
                                                              PID:1756
                                                            • C:\Program Files\Java\jdk1.7.0_80\db\backup.exe
                                                              "C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Drops file in Program Files directory
                                                              • System policy modification
                                                              PID:1936
                                                              • C:\Program Files\Java\jdk1.7.0_80\db\bin\update.exe
                                                                "C:\Program Files\Java\jdk1.7.0_80\db\bin\update.exe" C:\Program Files\Java\jdk1.7.0_80\db\bin\
                                                                8⤵
                                                                  PID:272
                                                                • C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe
                                                                  "C:\Program Files\Java\jdk1.7.0_80\db\lib\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\lib\
                                                                  8⤵
                                                                    PID:592
                                                                • C:\Program Files\Java\jdk1.7.0_80\include\backup.exe
                                                                  "C:\Program Files\Java\jdk1.7.0_80\include\backup.exe" C:\Program Files\Java\jdk1.7.0_80\include\
                                                                  7⤵
                                                                    PID:1500
                                                                  • C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe
                                                                    "C:\Program Files\Java\jdk1.7.0_80\jre\backup.exe" C:\Program Files\Java\jdk1.7.0_80\jre\
                                                                    7⤵
                                                                      PID:2140
                                                                  • C:\Program Files\Java\jre7\backup.exe
                                                                    "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
                                                                    6⤵
                                                                      PID:1992
                                                                  • C:\Program Files\Microsoft Games\backup.exe
                                                                    "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                    5⤵
                                                                      PID:1096
                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                      5⤵
                                                                        PID:1588
                                                                      • C:\Program Files\Mozilla Firefox\backup.exe
                                                                        "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                        5⤵
                                                                          PID:2156
                                                                      • C:\Program Files (x86)\backup.exe
                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                        4⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1036
                                                                        • C:\Program Files (x86)\Adobe\data.exe
                                                                          "C:\Program Files (x86)\Adobe\data.exe" C:\Program Files (x86)\Adobe\
                                                                          5⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:680
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                            6⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1736
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                              7⤵
                                                                                PID:908
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                7⤵
                                                                                  PID:1748
                                                                            • C:\Program Files (x86)\Common Files\backup.exe
                                                                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                              5⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1000
                                                                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                6⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:2036
                                                                                • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                  7⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Drops file in Program Files directory
                                                                                  • System policy modification
                                                                                  PID:1680
                                                                                • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                  7⤵
                                                                                    PID:1380
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                    7⤵
                                                                                      PID:1768
                                                                                  • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                    6⤵
                                                                                      PID:1772
                                                                                    • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                      6⤵
                                                                                        PID:2212
                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                      5⤵
                                                                                        PID:720
                                                                                      • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                        5⤵
                                                                                          PID:1516
                                                                                        • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                          "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                          5⤵
                                                                                            PID:2228
                                                                                        • C:\Users\backup.exe
                                                                                          C:\Users\backup.exe C:\Users\
                                                                                          4⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1584
                                                                                          • C:\Users\Admin\backup.exe
                                                                                            C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                            5⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            • System policy modification
                                                                                            PID:1060
                                                                                            • C:\Users\Admin\Contacts\backup.exe
                                                                                              C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                              6⤵
                                                                                              • Executes dropped EXE
                                                                                              PID:2016
                                                                                            • C:\Users\Admin\Desktop\backup.exe
                                                                                              C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                              6⤵
                                                                                                PID:1600
                                                                                              • C:\Users\Admin\Documents\backup.exe
                                                                                                C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                6⤵
                                                                                                  PID:2148
                                                                                              • C:\Users\Public\backup.exe
                                                                                                C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                5⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1232
                                                                                                • C:\Users\Public\Documents\backup.exe
                                                                                                  C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                  6⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  • System policy modification
                                                                                                  PID:1656
                                                                                                • C:\Users\Public\Downloads\backup.exe
                                                                                                  C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                  6⤵
                                                                                                    PID:1552
                                                                                                  • C:\Users\Public\Music\backup.exe
                                                                                                    C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                    6⤵
                                                                                                      PID:1804
                                                                                                • C:\Windows\backup.exe
                                                                                                  C:\Windows\backup.exe C:\Windows\
                                                                                                  4⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in Windows directory
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  • System policy modification
                                                                                                  PID:1812
                                                                                                  • C:\Windows\addins\backup.exe
                                                                                                    C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                    5⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:1612
                                                                                                  • C:\Windows\AppCompat\backup.exe
                                                                                                    C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                    5⤵
                                                                                                      PID:2044
                                                                                                    • C:\Windows\AppPatch\backup.exe
                                                                                                      C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                      5⤵
                                                                                                        PID:900
                                                                                                      • C:\Windows\assembly\backup.exe
                                                                                                        C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                        5⤵
                                                                                                          PID:2204
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                    2⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:2024
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                    2⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:848
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                    2⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:996
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                    2⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    PID:908
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                    2⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • System policy modification
                                                                                                    PID:1932
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                    2⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                    • System policy modification
                                                                                                    PID:1524

                                                                                                Network

                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                Replay Monitor

                                                                                                Loading Replay Monitor...

                                                                                                Downloads

                                                                                                • C:\PerfLogs\Admin\update.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0a37ae71de1a6eb33703e372b4be3d01

                                                                                                  SHA1

                                                                                                  ffdd423e6bffdcaf1e347b34749dd6d7b25b0956

                                                                                                  SHA256

                                                                                                  ed1bc0bc2c2d76d10a8b2d712f79a4434bdc015951f09c6ba8d13820621fbe62

                                                                                                  SHA512

                                                                                                  9342374481209e8b7ee978cd8180c6bf3ff7cf23321eddf12eea569c8b2e706a714acb6febf2f3cc2dab1c09061d1dfacfde3e7c49dc597dcd6c4fd5ef9f3d02

                                                                                                • C:\PerfLogs\Admin\update.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0a37ae71de1a6eb33703e372b4be3d01

                                                                                                  SHA1

                                                                                                  ffdd423e6bffdcaf1e347b34749dd6d7b25b0956

                                                                                                  SHA256

                                                                                                  ed1bc0bc2c2d76d10a8b2d712f79a4434bdc015951f09c6ba8d13820621fbe62

                                                                                                  SHA512

                                                                                                  9342374481209e8b7ee978cd8180c6bf3ff7cf23321eddf12eea569c8b2e706a714acb6febf2f3cc2dab1c09061d1dfacfde3e7c49dc597dcd6c4fd5ef9f3d02

                                                                                                • C:\PerfLogs\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • C:\PerfLogs\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  9580a4da49961726662187f608fd6011

                                                                                                  SHA1

                                                                                                  d481e5954e25ec69d02688d3fa98034caf060fc2

                                                                                                  SHA256

                                                                                                  2fc4cbfc4bb5ebe01a306bd86c63cbb759cc89763038d76cad420f35eb5a2bbc

                                                                                                  SHA512

                                                                                                  7b110ba6f24d6cd4e03df0616513560a47fd735caf6f25bfed9017486fccd65f3b5ad8f13d36523b050fc5c512403d86679e768e646407b23fc238915f69d8cb

                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • C:\Program Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • C:\Program Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • C:\Users\Admin\AppData\Local\Temp\2959381440\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\2959381440\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • C:\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  5ab92d27eb026ea68f05c88b8d8b75b9

                                                                                                  SHA1

                                                                                                  c56c8781b5af57eaf006b301fcbbb784049291b4

                                                                                                  SHA256

                                                                                                  fcd94688f5717bdec3133ecbaa51012ec13af7b24b77e4f1072f4bd626d99dcd

                                                                                                  SHA512

                                                                                                  79f554e42cbba5b06e14df40d3cf2123fda0110e26448ca3fd242156e2ba0343f077e4b1750753e3b9e47b4327bbfc4c8f80408f3801bafbecf30a354c096ae6

                                                                                                • C:\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  5ab92d27eb026ea68f05c88b8d8b75b9

                                                                                                  SHA1

                                                                                                  c56c8781b5af57eaf006b301fcbbb784049291b4

                                                                                                  SHA256

                                                                                                  fcd94688f5717bdec3133ecbaa51012ec13af7b24b77e4f1072f4bd626d99dcd

                                                                                                  SHA512

                                                                                                  79f554e42cbba5b06e14df40d3cf2123fda0110e26448ca3fd242156e2ba0343f077e4b1750753e3b9e47b4327bbfc4c8f80408f3801bafbecf30a354c096ae6

                                                                                                • \PerfLogs\Admin\update.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0a37ae71de1a6eb33703e372b4be3d01

                                                                                                  SHA1

                                                                                                  ffdd423e6bffdcaf1e347b34749dd6d7b25b0956

                                                                                                  SHA256

                                                                                                  ed1bc0bc2c2d76d10a8b2d712f79a4434bdc015951f09c6ba8d13820621fbe62

                                                                                                  SHA512

                                                                                                  9342374481209e8b7ee978cd8180c6bf3ff7cf23321eddf12eea569c8b2e706a714acb6febf2f3cc2dab1c09061d1dfacfde3e7c49dc597dcd6c4fd5ef9f3d02

                                                                                                • \PerfLogs\Admin\update.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0a37ae71de1a6eb33703e372b4be3d01

                                                                                                  SHA1

                                                                                                  ffdd423e6bffdcaf1e347b34749dd6d7b25b0956

                                                                                                  SHA256

                                                                                                  ed1bc0bc2c2d76d10a8b2d712f79a4434bdc015951f09c6ba8d13820621fbe62

                                                                                                  SHA512

                                                                                                  9342374481209e8b7ee978cd8180c6bf3ff7cf23321eddf12eea569c8b2e706a714acb6febf2f3cc2dab1c09061d1dfacfde3e7c49dc597dcd6c4fd5ef9f3d02

                                                                                                • \PerfLogs\Admin\update.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0a37ae71de1a6eb33703e372b4be3d01

                                                                                                  SHA1

                                                                                                  ffdd423e6bffdcaf1e347b34749dd6d7b25b0956

                                                                                                  SHA256

                                                                                                  ed1bc0bc2c2d76d10a8b2d712f79a4434bdc015951f09c6ba8d13820621fbe62

                                                                                                  SHA512

                                                                                                  9342374481209e8b7ee978cd8180c6bf3ff7cf23321eddf12eea569c8b2e706a714acb6febf2f3cc2dab1c09061d1dfacfde3e7c49dc597dcd6c4fd5ef9f3d02

                                                                                                • \PerfLogs\Admin\update.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0a37ae71de1a6eb33703e372b4be3d01

                                                                                                  SHA1

                                                                                                  ffdd423e6bffdcaf1e347b34749dd6d7b25b0956

                                                                                                  SHA256

                                                                                                  ed1bc0bc2c2d76d10a8b2d712f79a4434bdc015951f09c6ba8d13820621fbe62

                                                                                                  SHA512

                                                                                                  9342374481209e8b7ee978cd8180c6bf3ff7cf23321eddf12eea569c8b2e706a714acb6febf2f3cc2dab1c09061d1dfacfde3e7c49dc597dcd6c4fd5ef9f3d02

                                                                                                • \PerfLogs\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • \PerfLogs\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  ff77f0e32fe3afc35db1c1bc0d42acb0

                                                                                                  SHA1

                                                                                                  217f9b52db6a310c58fc942cbfeb98f5cb17e9cd

                                                                                                  SHA256

                                                                                                  a18101d8f84a9d4054a3d1c89c9f7900a5d16c005677184c90b235baa40bc36a

                                                                                                  SHA512

                                                                                                  811fbd9d622bd357bc29fef0995bc5df33dd4b791d95b86ef50531affc100bcbbb8b85a38758c6c5dc19eb87d407d723021e4d4f7a9a40b881350b1a3b7e0cd3

                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  9580a4da49961726662187f608fd6011

                                                                                                  SHA1

                                                                                                  d481e5954e25ec69d02688d3fa98034caf060fc2

                                                                                                  SHA256

                                                                                                  2fc4cbfc4bb5ebe01a306bd86c63cbb759cc89763038d76cad420f35eb5a2bbc

                                                                                                  SHA512

                                                                                                  7b110ba6f24d6cd4e03df0616513560a47fd735caf6f25bfed9017486fccd65f3b5ad8f13d36523b050fc5c512403d86679e768e646407b23fc238915f69d8cb

                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  9580a4da49961726662187f608fd6011

                                                                                                  SHA1

                                                                                                  d481e5954e25ec69d02688d3fa98034caf060fc2

                                                                                                  SHA256

                                                                                                  2fc4cbfc4bb5ebe01a306bd86c63cbb759cc89763038d76cad420f35eb5a2bbc

                                                                                                  SHA512

                                                                                                  7b110ba6f24d6cd4e03df0616513560a47fd735caf6f25bfed9017486fccd65f3b5ad8f13d36523b050fc5c512403d86679e768e646407b23fc238915f69d8cb

                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  e92d42318abfeb615d77c9dbc8f77ee3

                                                                                                  SHA1

                                                                                                  1f306e8e14db5233fb7ba100c688ae565afcca90

                                                                                                  SHA256

                                                                                                  b23bfd7512e0a355fb35fe76482fdcf71dcf5511221aa6a17fb540754baeddbd

                                                                                                  SHA512

                                                                                                  b427ed16808756fe862bcfac1c9cef6f63728866c6e946b0446b3f102ca69b39073b286be4d2928b47a474309af4f416636cac9ce4cdd28dcc64dcbdad6d6c8a

                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  9580a4da49961726662187f608fd6011

                                                                                                  SHA1

                                                                                                  d481e5954e25ec69d02688d3fa98034caf060fc2

                                                                                                  SHA256

                                                                                                  2fc4cbfc4bb5ebe01a306bd86c63cbb759cc89763038d76cad420f35eb5a2bbc

                                                                                                  SHA512

                                                                                                  7b110ba6f24d6cd4e03df0616513560a47fd735caf6f25bfed9017486fccd65f3b5ad8f13d36523b050fc5c512403d86679e768e646407b23fc238915f69d8cb

                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  0b0595273b1af0dfeb1da946bb4e0dbb

                                                                                                  SHA1

                                                                                                  8e5dd934a51e42ecf0557276923a9c103b510947

                                                                                                  SHA256

                                                                                                  fc40934bcca161ecf1508a3648e257495e2b5805fb3a3e0ca13a34a9971e850b

                                                                                                  SHA512

                                                                                                  5c04ef2860048367762a4dd426aff3604af912c7ba7908cf6922bec88ff03c95503572aa0b9d450eb6c0cea50b745d01e8eb8871b7eda8461ae0d8bc3dee944c

                                                                                                • \Program Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • \Program Files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  aa5fe7e5313cde71fdfb7307a6482166

                                                                                                  SHA1

                                                                                                  f1d983c07b63ea791c756adb9e82126e9cdf8011

                                                                                                  SHA256

                                                                                                  fc20e9d6f30b910f73c34d5268409c2e5af150c20c2bdba183a13c5e7ae362e4

                                                                                                  SHA512

                                                                                                  a410867bd46a3a64df11110deae0e81f8d1dcefdaaf680e4d23affd32948068b8653162f3f06fedfc63b275b9e39576abe0dac8708551317697a16e28937089d

                                                                                                • \Users\Admin\AppData\Local\Temp\2959381440\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\2959381440\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                  Filesize

                                                                                                  72KB

                                                                                                  MD5

                                                                                                  acb4f3717919d514f867f7c1e5de813f

                                                                                                  SHA1

                                                                                                  53e9079aca7db1877a3c160b6fb39b0b1da54398

                                                                                                  SHA256

                                                                                                  82b7f10e2fff0df91a2ea810dd1d7d82c5a7d3ee8b2125632adf692acde9cf7f

                                                                                                  SHA512

                                                                                                  2cf2194c3b04213ad861a7d2de7ab542007e8244c668512ef9e64ae40f057b2cd97510f29221508a60d892ffc94776a76804a6acb4eeba884826e44255eaae79

                                                                                                • memory/1032-111-0x0000000075601000-0x0000000075603000-memory.dmp

                                                                                                  Filesize

                                                                                                  8KB

                                                                                                • memory/1032-155-0x00000000742B1000-0x00000000742B3000-memory.dmp

                                                                                                  Filesize

                                                                                                  8KB