Analysis

  • max time kernel
    148s
  • max time network
    47s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 00:32

General

  • Target

    bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe

  • Size

    72KB

  • MD5

    0fea0bbb1ea050b843d9c47ecf6c90f0

  • SHA1

    97dad33402ade98f52cf8fac1d2834e63afcd5f7

  • SHA256

    bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0

  • SHA512

    d1fe4db5c4c47312035fd8d59b4eaa2f1027c31635ad2e3e54027932098eff646d8bf9c9b11b2d3b0b04358d5d31a96262b82665544f0cc9363e8cabcc1068cd

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2B:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPV

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe
    "C:\Users\Admin\AppData\Local\Temp\bf55486893d96c64eba40dc2e478f383a6b54ab3a2cbefe6ee6a54205bccdca0.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:872
    • C:\Users\Admin\AppData\Local\Temp\2159469762\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2159469762\backup.exe C:\Users\Admin\AppData\Local\Temp\2159469762\
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2020
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1172
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:848
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1408
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1996
          • C:\Program Files\7-Zip\data.exe
            "C:\Program Files\7-Zip\data.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:676
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:780
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1648
            • C:\Program Files\Common Files\Microsoft Shared\data.exe
              "C:\Program Files\Common Files\Microsoft Shared\data.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:240
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1916
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1404
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1548
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1516
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1424
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1724
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1624
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1620
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:556
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1768
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1500
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1884
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1700
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:284
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1964
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    PID:1916
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Disables RegEdit via registry modification
                    PID:1292
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                      PID:1144
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                      9⤵
                        PID:1076
                      • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\update.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                        9⤵
                          PID:1716
                      • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                        8⤵
                        • System policy modification
                        PID:1900
                      • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                        8⤵
                        • System policy modification
                        PID:568
                      • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                        8⤵
                          PID:1992
                        • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                          8⤵
                            PID:1816
                          • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                            8⤵
                              PID:784
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                            7⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:316
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1200
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1932
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:868
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1756
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:964
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1720
                          • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1768
                            • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1884
                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                            7⤵
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:544
                          • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:584
                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                            7⤵
                            • Drops file in Program Files directory
                            • System policy modification
                            PID:1340
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              PID:984
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                              8⤵
                                PID:364
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                                8⤵
                                  PID:1076
                                • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                                  8⤵
                                  • System policy modification
                                  PID:1732
                                • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                                  8⤵
                                    PID:1728
                                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                                    8⤵
                                      PID:600
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                    7⤵
                                    • Disables RegEdit via registry modification
                                    • Drops file in Program Files directory
                                    PID:1736
                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                                      8⤵
                                        PID:1564
                                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                                        8⤵
                                          PID:1492
                                        • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                                          8⤵
                                            PID:1292
                                          • C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
                                            8⤵
                                              PID:524
                                          • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                            7⤵
                                              PID:1832
                                            • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                              7⤵
                                                PID:1508
                                              • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                                "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                                7⤵
                                                  PID:1732
                                              • C:\Program Files\Common Files\Services\backup.exe
                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1904
                                              • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                                "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:600
                                                • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                                  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1748
                                              • C:\Program Files\Common Files\System\backup.exe
                                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1348
                                                • C:\Program Files\Common Files\System\ado\backup.exe
                                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:1984
                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1620
                                                  • C:\Program Files\Common Files\System\ado\en-US\data.exe
                                                    "C:\Program Files\Common Files\System\ado\en-US\data.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1500
                                                  • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1684
                                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                    8⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:832
                                                  • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    PID:1828
                                                  • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:1396
                                                • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                  7⤵
                                                  • Disables RegEdit via registry modification
                                                  PID:904
                                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • System policy modification
                                                  PID:1440
                                                • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                  "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                  7⤵
                                                    PID:848
                                                  • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                    "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                    7⤵
                                                      PID:1500
                                                    • C:\Program Files\Common Files\System\it-IT\update.exe
                                                      "C:\Program Files\Common Files\System\it-IT\update.exe" C:\Program Files\Common Files\System\it-IT\
                                                      7⤵
                                                        PID:1172
                                                  • C:\Program Files\DVD Maker\backup.exe
                                                    "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                    5⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1716
                                                    • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                      "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1792
                                                    • C:\Program Files\DVD Maker\en-US\backup.exe
                                                      "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                      6⤵
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1288
                                                    • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                      "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1488
                                                    • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                      "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1760
                                                    • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                      "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1344
                                                    • C:\Program Files\DVD Maker\ja-JP\data.exe
                                                      "C:\Program Files\DVD Maker\ja-JP\data.exe" C:\Program Files\DVD Maker\ja-JP\
                                                      6⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:556
                                                    • C:\Program Files\DVD Maker\Shared\backup.exe
                                                      "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1044
                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • Drops file in Program Files directory
                                                        PID:1908
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • System policy modification
                                                          PID:1548
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                          8⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • System policy modification
                                                          PID:1180
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                          8⤵
                                                          • Disables RegEdit via registry modification
                                                          • System policy modification
                                                          PID:752
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
                                                          8⤵
                                                            PID:1396
                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
                                                            8⤵
                                                              PID:844
                                                      • C:\Program Files\Google\System Restore.exe
                                                        "C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\
                                                        5⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:784
                                                        • C:\Program Files\Google\Chrome\backup.exe
                                                          "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                          6⤵
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1116
                                                          • C:\Program Files\Google\Chrome\Application\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                            7⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Drops file in Program Files directory
                                                            PID:696
                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              • Drops file in Program Files directory
                                                              PID:1740
                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                9⤵
                                                                  PID:2000
                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                  9⤵
                                                                    PID:484
                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                    9⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    PID:1176
                                                                • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                                  8⤵
                                                                  • System policy modification
                                                                  PID:1536
                                                                • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                  "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                  8⤵
                                                                    PID:868
                                                            • C:\Program Files\Internet Explorer\backup.exe
                                                              "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                              5⤵
                                                              • Drops file in Program Files directory
                                                              • System policy modification
                                                              PID:1876
                                                              • C:\Program Files\Internet Explorer\de-DE\update.exe
                                                                "C:\Program Files\Internet Explorer\de-DE\update.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                6⤵
                                                                  PID:1176
                                                                • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                  "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                  6⤵
                                                                    PID:1916
                                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                    6⤵
                                                                      PID:1632
                                                                    • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                      "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                      6⤵
                                                                        PID:1696
                                                                    • C:\Program Files\Java\backup.exe
                                                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                      5⤵
                                                                        PID:1640
                                                                      • C:\Program Files\Microsoft Games\backup.exe
                                                                        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                        5⤵
                                                                          PID:568
                                                                        • C:\Program Files\Microsoft Office\backup.exe
                                                                          "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                          5⤵
                                                                            PID:864
                                                                        • C:\Program Files (x86)\backup.exe
                                                                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                          4⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1020
                                                                          • C:\Program Files (x86)\Adobe\update.exe
                                                                            "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
                                                                            5⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Drops file in Program Files directory
                                                                            PID:844
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                              6⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • System policy modification
                                                                              PID:580
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                7⤵
                                                                                  PID:572
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                  7⤵
                                                                                    PID:1440
                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                    7⤵
                                                                                      PID:2220
                                                                                • C:\Program Files (x86)\Common Files\update.exe
                                                                                  "C:\Program Files (x86)\Common Files\update.exe" C:\Program Files (x86)\Common Files\
                                                                                  5⤵
                                                                                  • Disables RegEdit via registry modification
                                                                                  • System policy modification
                                                                                  PID:268
                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                    6⤵
                                                                                    • System policy modification
                                                                                    PID:692
                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                      7⤵
                                                                                        PID:756
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                        7⤵
                                                                                          PID:1216
                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                          7⤵
                                                                                            PID:2228
                                                                                        • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                          6⤵
                                                                                            PID:1364
                                                                                          • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                            6⤵
                                                                                              PID:696
                                                                                          • C:\Program Files (x86)\Google\update.exe
                                                                                            "C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\
                                                                                            5⤵
                                                                                              PID:632
                                                                                            • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                              "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                              5⤵
                                                                                                PID:1548
                                                                                              • C:\Program Files (x86)\Microsoft Analysis Services\update.exe
                                                                                                "C:\Program Files (x86)\Microsoft Analysis Services\update.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                5⤵
                                                                                                  PID:1036
                                                                                              • C:\Users\System Restore.exe
                                                                                                "C:\Users\System Restore.exe" C:\Users\
                                                                                                4⤵
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:980
                                                                                                • C:\Users\Admin\backup.exe
                                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                  5⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Executes dropped EXE
                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                  • System policy modification
                                                                                                  PID:1644
                                                                                                  • C:\Users\Admin\Contacts\System Restore.exe
                                                                                                    "C:\Users\Admin\Contacts\System Restore.exe" C:\Users\Admin\Contacts\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:640
                                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    • Disables RegEdit via registry modification
                                                                                                    • System policy modification
                                                                                                    PID:1640
                                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                    6⤵
                                                                                                    • System policy modification
                                                                                                    PID:1712
                                                                                                  • C:\Users\Admin\Downloads\backup.exe
                                                                                                    C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                    6⤵
                                                                                                      PID:1384
                                                                                                    • C:\Users\Admin\Favorites\backup.exe
                                                                                                      C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                      6⤵
                                                                                                        PID:1588
                                                                                                      • C:\Users\Admin\Links\backup.exe
                                                                                                        C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                        6⤵
                                                                                                          PID:1360
                                                                                                      • C:\Users\Public\backup.exe
                                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                        5⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • System policy modification
                                                                                                        PID:1620
                                                                                                        • C:\Users\Public\Documents\backup.exe
                                                                                                          C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • System policy modification
                                                                                                          PID:1572
                                                                                                        • C:\Users\Public\Downloads\backup.exe
                                                                                                          C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • System policy modification
                                                                                                          PID:576
                                                                                                        • C:\Users\Public\Music\backup.exe
                                                                                                          C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                          6⤵
                                                                                                            PID:832
                                                                                                          • C:\Users\Public\Pictures\backup.exe
                                                                                                            C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                            6⤵
                                                                                                              PID:1660
                                                                                                            • C:\Users\Public\Recorded TV\backup.exe
                                                                                                              "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
                                                                                                              6⤵
                                                                                                                PID:2236
                                                                                                          • C:\Windows\backup.exe
                                                                                                            C:\Windows\backup.exe C:\Windows\
                                                                                                            4⤵
                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Drops file in Windows directory
                                                                                                            • System policy modification
                                                                                                            PID:1772
                                                                                                            • C:\Windows\addins\backup.exe
                                                                                                              C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                              5⤵
                                                                                                                PID:640
                                                                                                              • C:\Windows\AppCompat\backup.exe
                                                                                                                C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                5⤵
                                                                                                                  PID:2004
                                                                                                                • C:\Windows\AppPatch\backup.exe
                                                                                                                  C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                  5⤵
                                                                                                                    PID:1712
                                                                                                                  • C:\Windows\assembly\backup.exe
                                                                                                                    C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                    5⤵
                                                                                                                      PID:1532
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                2⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • System policy modification
                                                                                                                PID:1240
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                2⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:1312
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                2⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • System policy modification
                                                                                                                PID:972
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                2⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • System policy modification
                                                                                                                PID:904
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                2⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:980
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                2⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                • System policy modification
                                                                                                                PID:1168

                                                                                                            Network

                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                            Replay Monitor

                                                                                                            Loading Replay Monitor...

                                                                                                            Downloads

                                                                                                            • C:\PerfLogs\Admin\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              04125e103cdeb1655cd3b4de220cdcd4

                                                                                                              SHA1

                                                                                                              216ab69a9cf7fc4870a45d5d998bfee09491825e

                                                                                                              SHA256

                                                                                                              f7bb5bf89c719e289e1019b8d666f46244f7e491476b093f4d2f2c4c485706f7

                                                                                                              SHA512

                                                                                                              0bcf228341cf0bf7f44c1a37b83f00e0eb423842e5a5108cec8e4c71b0fd1c0b55cda847f7d1c77fb9d38faa944725c367da64e82ac4c853eb6469e8e8482052

                                                                                                            • C:\PerfLogs\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              fd73ba287104833ea9761bb3ccc19405

                                                                                                              SHA1

                                                                                                              404637bab6fec42bae9b7ca80b7fb0c01e956389

                                                                                                              SHA256

                                                                                                              3aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18

                                                                                                              SHA512

                                                                                                              d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429

                                                                                                            • C:\PerfLogs\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              fd73ba287104833ea9761bb3ccc19405

                                                                                                              SHA1

                                                                                                              404637bab6fec42bae9b7ca80b7fb0c01e956389

                                                                                                              SHA256

                                                                                                              3aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18

                                                                                                              SHA512

                                                                                                              d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429

                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              9ae4b35fa8fb81db6b2f4016ebc7aa79

                                                                                                              SHA1

                                                                                                              f81b6ab30e6c050e7f9a389b4979a121d7e3a6b1

                                                                                                              SHA256

                                                                                                              91759a07bdb76161ce6684142441781361f31706feb2b6c645306827077512af

                                                                                                              SHA512

                                                                                                              58353681fdfba763b76f256c725eb790828506d7672db3803c178a79d59bd30d34b9e952cee3ce07da7385d0ada9b47c2c7baf328f708075355ed436e223a745

                                                                                                            • C:\Program Files\7-Zip\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              a238d174496300aa32294dad02e323df

                                                                                                              SHA1

                                                                                                              11cf2aa734f836f112336c05addde0dd025d1693

                                                                                                              SHA256

                                                                                                              6414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546

                                                                                                              SHA512

                                                                                                              5341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97

                                                                                                            • C:\Program Files\7-Zip\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              a238d174496300aa32294dad02e323df

                                                                                                              SHA1

                                                                                                              11cf2aa734f836f112336c05addde0dd025d1693

                                                                                                              SHA256

                                                                                                              6414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546

                                                                                                              SHA512

                                                                                                              5341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              67a9abc36300024738728880db989fb6

                                                                                                              SHA1

                                                                                                              6a41add47326cda3846171dcbe64fd4f8afabe75

                                                                                                              SHA256

                                                                                                              8499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004

                                                                                                              SHA512

                                                                                                              8295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              67a9abc36300024738728880db989fb6

                                                                                                              SHA1

                                                                                                              6a41add47326cda3846171dcbe64fd4f8afabe75

                                                                                                              SHA256

                                                                                                              8499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004

                                                                                                              SHA512

                                                                                                              8295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              8e50a5807a353168309e1df2137bef26

                                                                                                              SHA1

                                                                                                              6da02d9f59208e3b4a9e1a3117c257e40361561a

                                                                                                              SHA256

                                                                                                              b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37

                                                                                                              SHA512

                                                                                                              4011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5

                                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              8e50a5807a353168309e1df2137bef26

                                                                                                              SHA1

                                                                                                              6da02d9f59208e3b4a9e1a3117c257e40361561a

                                                                                                              SHA256

                                                                                                              b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37

                                                                                                              SHA512

                                                                                                              4011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5

                                                                                                            • C:\Program Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f30c6697a9a9a51ae11d36028c737511

                                                                                                              SHA1

                                                                                                              80a7bd7f69a02808e5ebc2de692caafa9844f41d

                                                                                                              SHA256

                                                                                                              f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978

                                                                                                              SHA512

                                                                                                              62dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5

                                                                                                            • C:\Program Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f30c6697a9a9a51ae11d36028c737511

                                                                                                              SHA1

                                                                                                              80a7bd7f69a02808e5ebc2de692caafa9844f41d

                                                                                                              SHA256

                                                                                                              f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978

                                                                                                              SHA512

                                                                                                              62dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2159469762\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2159469762\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f98306732322b080150775d29ecd9b8e

                                                                                                              SHA1

                                                                                                              286630324b5d674fd769d166a1dbe6617ee8a1bd

                                                                                                              SHA256

                                                                                                              8735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236

                                                                                                              SHA512

                                                                                                              1535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f98306732322b080150775d29ecd9b8e

                                                                                                              SHA1

                                                                                                              286630324b5d674fd769d166a1dbe6617ee8a1bd

                                                                                                              SHA256

                                                                                                              8735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236

                                                                                                              SHA512

                                                                                                              1535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              640b7d6d18a7262e974ab0f64f221026

                                                                                                              SHA1

                                                                                                              49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                              SHA256

                                                                                                              33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                              SHA512

                                                                                                              1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              378547eb659d946e749cd59c15eaab5d

                                                                                                              SHA1

                                                                                                              c20291ffbd1008429dc25f8123a4b6087501e2bb

                                                                                                              SHA256

                                                                                                              712fb78bcad9d15df2d80b4871c60a685ac03cdffc89244d225418c87087503b

                                                                                                              SHA512

                                                                                                              c3a0108a1ae8dd25e3ddb599ac5edf08d203cb3bf142213b678efe933da14a7a8f83fcc76ab295bfc8710c3b1d7ee29bc813c367c25eb8191a543a29d4c082c5

                                                                                                            • C:\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              5e9ce3009aa95820004c63102a148878

                                                                                                              SHA1

                                                                                                              8287ac18d336907f6c817a9756f4ddde4b3ac47f

                                                                                                              SHA256

                                                                                                              0c4c1efb179b1249450eee602fa6569a871a519b2955c5923e4c5f64964d8bd8

                                                                                                              SHA512

                                                                                                              0f12bf5faafd09d8aff1af30f7af123d4bc39c76d72553f342082299cd67ab6c0833177ab0df559bca013cdce7ef8f7a78390d465d283646c0907936370e4e9f

                                                                                                            • C:\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              5e9ce3009aa95820004c63102a148878

                                                                                                              SHA1

                                                                                                              8287ac18d336907f6c817a9756f4ddde4b3ac47f

                                                                                                              SHA256

                                                                                                              0c4c1efb179b1249450eee602fa6569a871a519b2955c5923e4c5f64964d8bd8

                                                                                                              SHA512

                                                                                                              0f12bf5faafd09d8aff1af30f7af123d4bc39c76d72553f342082299cd67ab6c0833177ab0df559bca013cdce7ef8f7a78390d465d283646c0907936370e4e9f

                                                                                                            • \PerfLogs\Admin\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              04125e103cdeb1655cd3b4de220cdcd4

                                                                                                              SHA1

                                                                                                              216ab69a9cf7fc4870a45d5d998bfee09491825e

                                                                                                              SHA256

                                                                                                              f7bb5bf89c719e289e1019b8d666f46244f7e491476b093f4d2f2c4c485706f7

                                                                                                              SHA512

                                                                                                              0bcf228341cf0bf7f44c1a37b83f00e0eb423842e5a5108cec8e4c71b0fd1c0b55cda847f7d1c77fb9d38faa944725c367da64e82ac4c853eb6469e8e8482052

                                                                                                            • \PerfLogs\Admin\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              04125e103cdeb1655cd3b4de220cdcd4

                                                                                                              SHA1

                                                                                                              216ab69a9cf7fc4870a45d5d998bfee09491825e

                                                                                                              SHA256

                                                                                                              f7bb5bf89c719e289e1019b8d666f46244f7e491476b093f4d2f2c4c485706f7

                                                                                                              SHA512

                                                                                                              0bcf228341cf0bf7f44c1a37b83f00e0eb423842e5a5108cec8e4c71b0fd1c0b55cda847f7d1c77fb9d38faa944725c367da64e82ac4c853eb6469e8e8482052

                                                                                                            • \PerfLogs\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              fd73ba287104833ea9761bb3ccc19405

                                                                                                              SHA1

                                                                                                              404637bab6fec42bae9b7ca80b7fb0c01e956389

                                                                                                              SHA256

                                                                                                              3aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18

                                                                                                              SHA512

                                                                                                              d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429

                                                                                                            • \PerfLogs\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              fd73ba287104833ea9761bb3ccc19405

                                                                                                              SHA1

                                                                                                              404637bab6fec42bae9b7ca80b7fb0c01e956389

                                                                                                              SHA256

                                                                                                              3aec75f3e02d35b3408ca184b8ef40f0f29a2374996769c5ee770a7e07b94e18

                                                                                                              SHA512

                                                                                                              d106cbd1d0935a46ebec824212f13a4582408b979029a9ee92875684eaa8a244e9982003cd7e5c5f2a47d5cd51f6f6c2e980881006aa39127551a7fc2fc5d429

                                                                                                            • \Program Files\7-Zip\Lang\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              9ae4b35fa8fb81db6b2f4016ebc7aa79

                                                                                                              SHA1

                                                                                                              f81b6ab30e6c050e7f9a389b4979a121d7e3a6b1

                                                                                                              SHA256

                                                                                                              91759a07bdb76161ce6684142441781361f31706feb2b6c645306827077512af

                                                                                                              SHA512

                                                                                                              58353681fdfba763b76f256c725eb790828506d7672db3803c178a79d59bd30d34b9e952cee3ce07da7385d0ada9b47c2c7baf328f708075355ed436e223a745

                                                                                                            • \Program Files\7-Zip\Lang\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              9ae4b35fa8fb81db6b2f4016ebc7aa79

                                                                                                              SHA1

                                                                                                              f81b6ab30e6c050e7f9a389b4979a121d7e3a6b1

                                                                                                              SHA256

                                                                                                              91759a07bdb76161ce6684142441781361f31706feb2b6c645306827077512af

                                                                                                              SHA512

                                                                                                              58353681fdfba763b76f256c725eb790828506d7672db3803c178a79d59bd30d34b9e952cee3ce07da7385d0ada9b47c2c7baf328f708075355ed436e223a745

                                                                                                            • \Program Files\7-Zip\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              a238d174496300aa32294dad02e323df

                                                                                                              SHA1

                                                                                                              11cf2aa734f836f112336c05addde0dd025d1693

                                                                                                              SHA256

                                                                                                              6414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546

                                                                                                              SHA512

                                                                                                              5341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97

                                                                                                            • \Program Files\7-Zip\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              a238d174496300aa32294dad02e323df

                                                                                                              SHA1

                                                                                                              11cf2aa734f836f112336c05addde0dd025d1693

                                                                                                              SHA256

                                                                                                              6414f5728e132b1ace3cd8955079847d27ca834156c939cab4ff8745a1cf7546

                                                                                                              SHA512

                                                                                                              5341753496afbac68676684ae4f1053975fc292b0a5e0be29881fd4b4949a231eb79a04fb7ad05e4075a2a5ca19eaecc79db8b49e676b352549b4e8bfe4a1b97

                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • \Program Files\Common Files\Microsoft Shared\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              67a9abc36300024738728880db989fb6

                                                                                                              SHA1

                                                                                                              6a41add47326cda3846171dcbe64fd4f8afabe75

                                                                                                              SHA256

                                                                                                              8499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004

                                                                                                              SHA512

                                                                                                              8295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8

                                                                                                            • \Program Files\Common Files\Microsoft Shared\data.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              67a9abc36300024738728880db989fb6

                                                                                                              SHA1

                                                                                                              6a41add47326cda3846171dcbe64fd4f8afabe75

                                                                                                              SHA256

                                                                                                              8499e59ccbec9abfab8e59a89a36736506d73a9841c2e56c5d7e534135901004

                                                                                                              SHA512

                                                                                                              8295304cc8199b77e9e4930bdb6674eed5c9fad9a211ec9a9700bb5939e665ee5b13841c46bf5760926fb5982d2fa4d2092bb767a13a0b806bf180844f7122d8

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              c943bff8618b95d51c64c6e31c03a1a1

                                                                                                              SHA1

                                                                                                              e1ef436a4c868b6de4e13a2f23aeabaf30ea7934

                                                                                                              SHA256

                                                                                                              e06076f5b7a6572bdd2d10f16931ade07d3c12d5b92c1c8e0f3f26be24e4ab29

                                                                                                              SHA512

                                                                                                              23e7049f17e1f1670ca441ce62a2322a1e14c59f41cc64e12f204fe0815fd8e8d7c573be6720575a63d390c176b7f4bf67043dcc7c57d4c07f415f7f2567d9da

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              6cd1d951819319391d9844ee92818002

                                                                                                              SHA1

                                                                                                              a09bb703b138897cc39636152349420e152622ca

                                                                                                              SHA256

                                                                                                              c4334600b35f5ebf44855610615d7d3dad5705a4c31d5026377e5a7d6c4f18c2

                                                                                                              SHA512

                                                                                                              12ac73c98f412741aa369c7208bc0348b7bbdc7592c9be8cd002bc88148027ec7c8c596756afe4416d025bcd8fd53b4d1d07ef5c2c46fc82fec5f168f252c839

                                                                                                            • \Program Files\Common Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              8e50a5807a353168309e1df2137bef26

                                                                                                              SHA1

                                                                                                              6da02d9f59208e3b4a9e1a3117c257e40361561a

                                                                                                              SHA256

                                                                                                              b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37

                                                                                                              SHA512

                                                                                                              4011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5

                                                                                                            • \Program Files\Common Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              8e50a5807a353168309e1df2137bef26

                                                                                                              SHA1

                                                                                                              6da02d9f59208e3b4a9e1a3117c257e40361561a

                                                                                                              SHA256

                                                                                                              b4f072f41c69e43dc707711f4d4a8dbbd6a0416e82bcd23454c383dcf7a83d37

                                                                                                              SHA512

                                                                                                              4011ae29bc2c550377c52aab0ce2a7d2d37b056b65d21f08d380f8c6d20686a1f1f5468c789b8f9807e0c2dd897d01f3a571d1671b5f3ea313f992e654d2a6a5

                                                                                                            • \Program Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f30c6697a9a9a51ae11d36028c737511

                                                                                                              SHA1

                                                                                                              80a7bd7f69a02808e5ebc2de692caafa9844f41d

                                                                                                              SHA256

                                                                                                              f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978

                                                                                                              SHA512

                                                                                                              62dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5

                                                                                                            • \Program Files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f30c6697a9a9a51ae11d36028c737511

                                                                                                              SHA1

                                                                                                              80a7bd7f69a02808e5ebc2de692caafa9844f41d

                                                                                                              SHA256

                                                                                                              f85cdff7a919693045efd3ba13ddf1290abce4d7da440b80dbed4b2935733978

                                                                                                              SHA512

                                                                                                              62dae81adf80044fa013353b85c6d2f751a4016f3dbe2528de42c7eda4048b833ff0a8576ece7a142640c7678008c0a47ccca3818e580b68ccbcd45813bc48a5

                                                                                                            • \Users\Admin\AppData\Local\Temp\2159469762\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • \Users\Admin\AppData\Local\Temp\2159469762\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f98306732322b080150775d29ecd9b8e

                                                                                                              SHA1

                                                                                                              286630324b5d674fd769d166a1dbe6617ee8a1bd

                                                                                                              SHA256

                                                                                                              8735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236

                                                                                                              SHA512

                                                                                                              1535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd

                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f98306732322b080150775d29ecd9b8e

                                                                                                              SHA1

                                                                                                              286630324b5d674fd769d166a1dbe6617ee8a1bd

                                                                                                              SHA256

                                                                                                              8735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236

                                                                                                              SHA512

                                                                                                              1535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd

                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f98306732322b080150775d29ecd9b8e

                                                                                                              SHA1

                                                                                                              286630324b5d674fd769d166a1dbe6617ee8a1bd

                                                                                                              SHA256

                                                                                                              8735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236

                                                                                                              SHA512

                                                                                                              1535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd

                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              f98306732322b080150775d29ecd9b8e

                                                                                                              SHA1

                                                                                                              286630324b5d674fd769d166a1dbe6617ee8a1bd

                                                                                                              SHA256

                                                                                                              8735323c68b0e7e427ca39e8623a152feae81ab14340e26176f8490a69c44236

                                                                                                              SHA512

                                                                                                              1535f621d101b8b2e9049d155703b4741404cd3f3710bfce75e426e5b5594f5c08ae95475201b3a06cabfba0b3f526eb23c96cea6179ba19d4bd46e6640f2acd

                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              640b7d6d18a7262e974ab0f64f221026

                                                                                                              SHA1

                                                                                                              49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                              SHA256

                                                                                                              33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                              SHA512

                                                                                                              1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              640b7d6d18a7262e974ab0f64f221026

                                                                                                              SHA1

                                                                                                              49be78a53617b1f50ec83fc343567e6c50f3b0f1

                                                                                                              SHA256

                                                                                                              33d9d6226bdbf52f224304505b0fb7bf497a0603a1d86ac7391ca471a26e1648

                                                                                                              SHA512

                                                                                                              1a59b753a978287cdc3f6de0913ea42bf9b1b3cb411410f3facc443451457f474348441fc20d472d4452dfa7447901d1d7cfc979130bcf18bc7e82d961786b05

                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              778644173f1c62eee30660bde8d79534

                                                                                                              SHA1

                                                                                                              2c177b4b9cfcc81534700fb91e5c1b1b7a55dd5c

                                                                                                              SHA256

                                                                                                              84ce3f92b2b85f0b531e7339db5a575e7a0e386dcccabda4649880e2f72658e7

                                                                                                              SHA512

                                                                                                              f02e37faf9ab0a976640bb6242a7b4ce36f64a183081cd33b5b6422de214f2e95ee0e4dea84b8892f7479b557d429b1854de02bbd78721d03a7bb9245d5ed6db

                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              378547eb659d946e749cd59c15eaab5d

                                                                                                              SHA1

                                                                                                              c20291ffbd1008429dc25f8123a4b6087501e2bb

                                                                                                              SHA256

                                                                                                              712fb78bcad9d15df2d80b4871c60a685ac03cdffc89244d225418c87087503b

                                                                                                              SHA512

                                                                                                              c3a0108a1ae8dd25e3ddb599ac5edf08d203cb3bf142213b678efe933da14a7a8f83fcc76ab295bfc8710c3b1d7ee29bc813c367c25eb8191a543a29d4c082c5

                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                              Filesize

                                                                                                              72KB

                                                                                                              MD5

                                                                                                              378547eb659d946e749cd59c15eaab5d

                                                                                                              SHA1

                                                                                                              c20291ffbd1008429dc25f8123a4b6087501e2bb

                                                                                                              SHA256

                                                                                                              712fb78bcad9d15df2d80b4871c60a685ac03cdffc89244d225418c87087503b

                                                                                                              SHA512

                                                                                                              c3a0108a1ae8dd25e3ddb599ac5edf08d203cb3bf142213b678efe933da14a7a8f83fcc76ab295bfc8710c3b1d7ee29bc813c367c25eb8191a543a29d4c082c5

                                                                                                            • memory/872-186-0x0000000074631000-0x0000000074633000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB

                                                                                                            • memory/872-131-0x00000000764D1000-0x00000000764D3000-memory.dmp

                                                                                                              Filesize

                                                                                                              8KB