Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    124s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 17:30

General

  • Target

    20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe

  • Size

    72KB

  • MD5

    0d4b6365fc3e16318df9a711f51a0e9e

  • SHA1

    f3bd1f90f2fceef697658f624c4a8213cd4ba2d2

  • SHA256

    20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd

  • SHA512

    0906a786e4ead16ca9e3d87be6a8684b64729a0e6d1c6d631f2808ece351bd708c1b9040ae1cb94eaf9872ccb92a9ad9330a7b6c3b8ac9e7573dd2e58bfe213b

  • SSDEEP

    768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyvg:HeT7BVwxfvqguKRFAl

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 59 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 58 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe
    "C:\Users\Admin\AppData\Local\Temp\20d233fda45b46c1e7cdaf96303c989883e952ec2f96aaf337d08b9d072c83bd.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe
      "C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\1644795293\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:968
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:688
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:836
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1084
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1920
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1944
            • C:\Program Files\7-Zip\Lang\data.exe
              "C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1392
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1040
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1928
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:440
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1244
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1984
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2012
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1624
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  PID:1844
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                    PID:2016
                  • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                    8⤵
                      PID:1576
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:896
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:824
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:112
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:2032
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                      8⤵
                      • Executes dropped EXE
                      PID:1984
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                      8⤵
                        PID:360
                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:1360
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                        8⤵
                          PID:1804
                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                          PID:1996
                        • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                          7⤵
                            PID:108
                        • C:\Program Files\Common Files\Services\backup.exe
                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:980
                        • C:\Program Files\Common Files\SpeechEngines\backup.exe
                          "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          PID:1648
                          • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                            "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1200
                        • C:\Program Files\Common Files\System\backup.exe
                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:268
                          • C:\Program Files\Common Files\System\ado\backup.exe
                            "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1692
                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:1640
                            • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                              "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                              8⤵
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              PID:960
                            • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                              "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                              8⤵
                                PID:1992
                              • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                8⤵
                                  PID:112
                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                7⤵
                                  PID:784
                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                  7⤵
                                    PID:848
                              • C:\Program Files\DVD Maker\backup.exe
                                "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                5⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Loads dropped DLL
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1752
                                • C:\Program Files\DVD Maker\de-DE\backup.exe
                                  "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1988
                                • C:\Program Files\DVD Maker\en-US\backup.exe
                                  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1112
                                • C:\Program Files\DVD Maker\es-ES\backup.exe
                                  "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:840
                                • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                  "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:572
                                • C:\Program Files\DVD Maker\it-IT\data.exe
                                  "C:\Program Files\DVD Maker\it-IT\data.exe" C:\Program Files\DVD Maker\it-IT\
                                  6⤵
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:976
                                • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                  "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                  6⤵
                                    PID:1740
                                  • C:\Program Files\DVD Maker\Shared\backup.exe
                                    "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                    6⤵
                                      PID:1080
                                  • C:\Program Files\Google\backup.exe
                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Loads dropped DLL
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:900
                                    • C:\Program Files\Google\Chrome\backup.exe
                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:1688
                                      • C:\Program Files\Google\Chrome\Application\backup.exe
                                        "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1944
                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe
                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\System Restore.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:956
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                            9⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1564
                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                            9⤵
                                              PID:1756
                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                              9⤵
                                                PID:1776
                                            • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                              "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                              8⤵
                                                PID:1624
                                        • C:\Program Files\Internet Explorer\backup.exe
                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:672
                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1364
                                          • C:\Program Files\Internet Explorer\en-US\data.exe
                                            "C:\Program Files\Internet Explorer\en-US\data.exe" C:\Program Files\Internet Explorer\en-US\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1784
                                          • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                            "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:824
                                          • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                            "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                            6⤵
                                              PID:2004
                                            • C:\Program Files\Internet Explorer\images\backup.exe
                                              "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                              6⤵
                                                PID:1800
                                              • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                6⤵
                                                  PID:1656
                                              • C:\Program Files\Java\backup.exe
                                                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                5⤵
                                                  PID:1628
                                                • C:\Program Files\Microsoft Games\backup.exe
                                                  "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                  5⤵
                                                    PID:1112
                                                • C:\Program Files (x86)\backup.exe
                                                  "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                  4⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Loads dropped DLL
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:964
                                                  • C:\Program Files (x86)\Adobe\backup.exe
                                                    "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                    5⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:556
                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                      6⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:1544
                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:1240
                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Executes dropped EXE
                                                        • Drops file in Program Files directory
                                                        • Suspicious use of SetWindowsHookEx
                                                        • System policy modification
                                                        PID:2000
                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                          8⤵
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1304
                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                          8⤵
                                                            PID:592
                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                            8⤵
                                                              PID:1288
                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                            7⤵
                                                              PID:2008
                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                              7⤵
                                                                PID:1280
                                                          • C:\Program Files (x86)\Common Files\backup.exe
                                                            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                            5⤵
                                                              PID:1368
                                                            • C:\Program Files (x86)\Google\backup.exe
                                                              "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                              5⤵
                                                                PID:1784
                                                            • C:\Users\backup.exe
                                                              C:\Users\backup.exe C:\Users\
                                                              4⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:1660
                                                              • C:\Users\Admin\backup.exe
                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                5⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:2044
                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1960
                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1628
                                                                • C:\Users\Admin\Documents\backup.exe
                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                  6⤵
                                                                  • Modifies visibility of file extensions in Explorer
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:1516
                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                  6⤵
                                                                    PID:1036
                                                                  • C:\Users\Admin\Favorites\backup.exe
                                                                    C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                    6⤵
                                                                      PID:1608
                                                                    • C:\Users\Admin\Links\update.exe
                                                                      C:\Users\Admin\Links\update.exe C:\Users\Admin\Links\
                                                                      6⤵
                                                                        PID:1916
                                                                    • C:\Users\Public\backup.exe
                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                      5⤵
                                                                        PID:840
                                                                    • C:\Windows\backup.exe
                                                                      C:\Windows\backup.exe C:\Windows\
                                                                      4⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Drops file in Windows directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:1900
                                                                      • C:\Windows\addins\backup.exe
                                                                        C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1064
                                                                      • C:\Windows\AppCompat\backup.exe
                                                                        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1036
                                                                      • C:\Windows\AppPatch\System Restore.exe
                                                                        "C:\Windows\AppPatch\System Restore.exe" C:\Windows\AppPatch\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1788
                                                                        • C:\Windows\AppPatch\AppPatch64\backup.exe
                                                                          C:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1492
                                                                        • C:\Windows\AppPatch\Custom\backup.exe
                                                                          C:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\
                                                                          6⤵
                                                                            PID:1960
                                                                          • C:\Windows\AppPatch\de-DE\backup.exe
                                                                            C:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\
                                                                            6⤵
                                                                              PID:1348
                                                                            • C:\Windows\AppPatch\en-US\backup.exe
                                                                              C:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\
                                                                              6⤵
                                                                                PID:1404
                                                                            • C:\Windows\assembly\backup.exe
                                                                              C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                              5⤵
                                                                                PID:808
                                                                                • C:\Windows\assembly\GAC\backup.exe
                                                                                  C:\Windows\assembly\GAC\backup.exe C:\Windows\assembly\GAC\
                                                                                  6⤵
                                                                                    PID:2024
                                                                                • C:\Windows\Branding\backup.exe
                                                                                  C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                  5⤵
                                                                                    PID:1364
                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                              2⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1404
                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                              2⤵
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:1744
                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                              2⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:336
                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                              2⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1372
                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                              2⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:672
                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                              2⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Executes dropped EXE
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              • System policy modification
                                                                              PID:1064

                                                                          Network

                                                                          MITRE ATT&CK Enterprise v6

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          • C:\PerfLogs\Admin\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            b2bba64bbd2c59cf57062866c037c54d

                                                                            SHA1

                                                                            f3a0aeeae1d074638bfa6eb6869d42227ceca161

                                                                            SHA256

                                                                            eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193

                                                                            SHA512

                                                                            d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998

                                                                          • C:\PerfLogs\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a9649987cede809582138a81231edc44

                                                                            SHA1

                                                                            6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

                                                                            SHA256

                                                                            582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

                                                                            SHA512

                                                                            f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

                                                                          • C:\PerfLogs\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a9649987cede809582138a81231edc44

                                                                            SHA1

                                                                            6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

                                                                            SHA256

                                                                            582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

                                                                            SHA512

                                                                            f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

                                                                          • C:\Program Files (x86)\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f1e48727987f0884d21a1a2300b8491e

                                                                            SHA1

                                                                            505b7818aa30d84833bf03e7d56f7f0b5f456b8c

                                                                            SHA256

                                                                            c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4

                                                                            SHA512

                                                                            772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb

                                                                          • C:\Program Files\7-Zip\Lang\data.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            33f18b9436f1c71f2af6e975f327115c

                                                                            SHA1

                                                                            c02310867b895954b85e4e748d48beca3b2f03bf

                                                                            SHA256

                                                                            13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

                                                                            SHA512

                                                                            f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

                                                                          • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • C:\Program Files\Common Files\Services\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            d634fa085cde5e91f623643c4c9bf45b

                                                                            SHA1

                                                                            8dca033ce4c9baffd7a94ef05dc0cf04bb500e12

                                                                            SHA256

                                                                            971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d

                                                                            SHA512

                                                                            41586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa

                                                                          • C:\Program Files\Common Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • C:\Program Files\Common Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • C:\Program Files\DVD Maker\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            dee18dd1bade284a420b72462ed970c5

                                                                            SHA1

                                                                            05fb9544d0c416fee8ab962bf99b38511bc923af

                                                                            SHA256

                                                                            c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960

                                                                            SHA512

                                                                            c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44

                                                                          • C:\Program Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            665c8b8832e0c83c39633155bfbaea77

                                                                            SHA1

                                                                            e6977529e69df9afa187434abb7b4e2d371e60d5

                                                                            SHA256

                                                                            35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

                                                                            SHA512

                                                                            16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

                                                                          • C:\Program Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            665c8b8832e0c83c39633155bfbaea77

                                                                            SHA1

                                                                            e6977529e69df9afa187434abb7b4e2d371e60d5

                                                                            SHA256

                                                                            35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

                                                                            SHA512

                                                                            16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

                                                                          • C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • C:\Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • C:\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            cd32f587821c58e3146923e96265f92e

                                                                            SHA1

                                                                            a3cf848769f729a675ea20ba4b0d0fe6ada44b94

                                                                            SHA256

                                                                            8bf7399e01496cbba55133d038941bf148b397f823effe9298b964d58ed60e84

                                                                            SHA512

                                                                            69c484c5f06a8777f42cc1f9c9f30ac5bc1a64b401b47b0e702ecd9be67f8d757de8cb40e92470aeebfeb38cda823920c888a732429ac85c0a66c6569b7c7aa2

                                                                          • C:\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            cd32f587821c58e3146923e96265f92e

                                                                            SHA1

                                                                            a3cf848769f729a675ea20ba4b0d0fe6ada44b94

                                                                            SHA256

                                                                            8bf7399e01496cbba55133d038941bf148b397f823effe9298b964d58ed60e84

                                                                            SHA512

                                                                            69c484c5f06a8777f42cc1f9c9f30ac5bc1a64b401b47b0e702ecd9be67f8d757de8cb40e92470aeebfeb38cda823920c888a732429ac85c0a66c6569b7c7aa2

                                                                          • \PerfLogs\Admin\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            b2bba64bbd2c59cf57062866c037c54d

                                                                            SHA1

                                                                            f3a0aeeae1d074638bfa6eb6869d42227ceca161

                                                                            SHA256

                                                                            eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193

                                                                            SHA512

                                                                            d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998

                                                                          • \PerfLogs\Admin\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            b2bba64bbd2c59cf57062866c037c54d

                                                                            SHA1

                                                                            f3a0aeeae1d074638bfa6eb6869d42227ceca161

                                                                            SHA256

                                                                            eaee6d25a07a17b6115c06adb208b308868d56b92c8a3bbfc4fe133316b7e193

                                                                            SHA512

                                                                            d6735041c4b8fb14548cda753fbca30fbf52879626ff79d1b62230a5c3c5df09e363e10d3a67705fbbca2ae088d751933040021a1bc516f21fc6a364a9e3a998

                                                                          • \PerfLogs\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a9649987cede809582138a81231edc44

                                                                            SHA1

                                                                            6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

                                                                            SHA256

                                                                            582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

                                                                            SHA512

                                                                            f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

                                                                          • \PerfLogs\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a9649987cede809582138a81231edc44

                                                                            SHA1

                                                                            6f794d2a850f1268b5dc032a3b7c149c7f5bc94f

                                                                            SHA256

                                                                            582fd43ebb813970f69552bd2eb01b559b4b4aebaa393426c40d935d08bd4a1c

                                                                            SHA512

                                                                            f89ef7da5d93426646d17a0548a3534aa2cbb14848cc3f261ee8a0c36659d83b832539d21d9a3f2ef5087a424cf445a6572265cf85b85b12a68b328ea3889ab7

                                                                          • \Program Files (x86)\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f1e48727987f0884d21a1a2300b8491e

                                                                            SHA1

                                                                            505b7818aa30d84833bf03e7d56f7f0b5f456b8c

                                                                            SHA256

                                                                            c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4

                                                                            SHA512

                                                                            772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb

                                                                          • \Program Files (x86)\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f1e48727987f0884d21a1a2300b8491e

                                                                            SHA1

                                                                            505b7818aa30d84833bf03e7d56f7f0b5f456b8c

                                                                            SHA256

                                                                            c9f50bb3787d47528eac354793248ce54345bbc9c59d453b535d2d3b750c92a4

                                                                            SHA512

                                                                            772b85375523ca0fd2f97dc1121807356d89d23693996dad422f7f0ed5d13f774fadccefe1846df17831dad55c01b09a039f779bfcbdeae2a02ad4b9920bb6eb

                                                                          • \Program Files\7-Zip\Lang\data.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • \Program Files\7-Zip\Lang\data.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • \Program Files\7-Zip\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • \Program Files\7-Zip\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            33f18b9436f1c71f2af6e975f327115c

                                                                            SHA1

                                                                            c02310867b895954b85e4e748d48beca3b2f03bf

                                                                            SHA256

                                                                            13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

                                                                            SHA512

                                                                            f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

                                                                          • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            33f18b9436f1c71f2af6e975f327115c

                                                                            SHA1

                                                                            c02310867b895954b85e4e748d48beca3b2f03bf

                                                                            SHA256

                                                                            13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

                                                                            SHA512

                                                                            f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

                                                                          • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            a28a15c096fe78cb2d53a00ae142ed59

                                                                            SHA1

                                                                            5d54e19d4bf0e3a277ff29fd17f4550282839c62

                                                                            SHA256

                                                                            2add655a42207834df35a4af18c497babb7c9056b4bfbf2efe0a3a518a96237b

                                                                            SHA512

                                                                            1584a18b1b925c4b608d56811b46c9403922ac330f2dfd4f6119419a85179823c5ac51036b377abd1e5860ba21035bde8c918782c61e4a9bfc78d006a5ca7d4e

                                                                          • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            33f18b9436f1c71f2af6e975f327115c

                                                                            SHA1

                                                                            c02310867b895954b85e4e748d48beca3b2f03bf

                                                                            SHA256

                                                                            13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

                                                                            SHA512

                                                                            f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

                                                                          • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            33f18b9436f1c71f2af6e975f327115c

                                                                            SHA1

                                                                            c02310867b895954b85e4e748d48beca3b2f03bf

                                                                            SHA256

                                                                            13920a886d8f7672c80ba5f9eed1398c79d9d24aa6952e7ad8585b7a46439b4d

                                                                            SHA512

                                                                            f781eb12868aaa2b0cf9d0979ec075d60eb8522c552fc92693ca2b2de5cbe4a1686e69309bcc324cacd9000f3731807e597490a643cbd6c9a83f186316bf576b

                                                                          • \Program Files\Common Files\Services\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            d634fa085cde5e91f623643c4c9bf45b

                                                                            SHA1

                                                                            8dca033ce4c9baffd7a94ef05dc0cf04bb500e12

                                                                            SHA256

                                                                            971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d

                                                                            SHA512

                                                                            41586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa

                                                                          • \Program Files\Common Files\Services\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            d634fa085cde5e91f623643c4c9bf45b

                                                                            SHA1

                                                                            8dca033ce4c9baffd7a94ef05dc0cf04bb500e12

                                                                            SHA256

                                                                            971eab7d2c00e9b6c7036f67c8f5d040374109f8b7e9743f0149fa3ffa968c2d

                                                                            SHA512

                                                                            41586244765fffb5a226a3905a4c24bbfc7a264eab49def933b441970da53a394bd15be6436a645c74e10fadd0f894bb0a279ed93a575bd0ed47ca7ae77397aa

                                                                          • \Program Files\Common Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • \Program Files\Common Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            7a95b97eae5d7288c02e87ed03902d03

                                                                            SHA1

                                                                            4c1c46af4c47c9dec5ede1c92d56d4d541e6fb93

                                                                            SHA256

                                                                            9650333956f4abb98c7d034c28b616a73449f89716f7bcf004fb17a7f2124960

                                                                            SHA512

                                                                            e2d3d7ba21a8347f0b893ef137e175edf821ccb264406dab3e31cc3c6cb8926c368b90f29b6972a83b9a5419f701487ac54a712829a5be97a94de46dfee4d01a

                                                                          • \Program Files\DVD Maker\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            dee18dd1bade284a420b72462ed970c5

                                                                            SHA1

                                                                            05fb9544d0c416fee8ab962bf99b38511bc923af

                                                                            SHA256

                                                                            c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960

                                                                            SHA512

                                                                            c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44

                                                                          • \Program Files\DVD Maker\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            dee18dd1bade284a420b72462ed970c5

                                                                            SHA1

                                                                            05fb9544d0c416fee8ab962bf99b38511bc923af

                                                                            SHA256

                                                                            c1997d3135dd494e842266b6c0e5ce911121aba3a93ac1a874a365f992946960

                                                                            SHA512

                                                                            c3219196c60daf254a8614aa57fe2958a0bac41851e1cfa05cdc5a25111b264c9c95d65f0fbc016c87e77fb7ac8df7af5d9063cbfdd4ffaf69bcddd8ca006f44

                                                                          • \Program Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            665c8b8832e0c83c39633155bfbaea77

                                                                            SHA1

                                                                            e6977529e69df9afa187434abb7b4e2d371e60d5

                                                                            SHA256

                                                                            35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

                                                                            SHA512

                                                                            16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

                                                                          • \Program Files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            665c8b8832e0c83c39633155bfbaea77

                                                                            SHA1

                                                                            e6977529e69df9afa187434abb7b4e2d371e60d5

                                                                            SHA256

                                                                            35d3b725f624f4375e8cd3ebd7c1b49b728d97754b148cbd1f38a8723a14eafa

                                                                            SHA512

                                                                            16b2b23d318fd77197ea868efe1dd38ab8a081c27c72be6df7fb95271b5618ed4186d1053e8090cc04a49328aa3c4ca8d43f00823344ee77e614c45b578bc871

                                                                          • \Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • \Users\Admin\AppData\Local\Temp\1644795293\System Restore.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            657b2093b71955e34a599b7a6eb9d6cc

                                                                            SHA1

                                                                            e1c23aec2d110711d5f61189202ef2b2bfe1ae6a

                                                                            SHA256

                                                                            7a120d43f345cf2872af049668f905e675c3f8ad74b187e4ab8ea0388d3a3c01

                                                                            SHA512

                                                                            099da7ec6b33dc8d5c9ec5f2a0fe9a44ff0dcd3f64ae83888b362cf1cedced4506392b02e4ca51129e27a4c8d51a1a590672af7288c0f77705e49fb13917c1e3

                                                                          • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                            Filesize

                                                                            72KB

                                                                            MD5

                                                                            f4b2f128bc0fd1d155baa5380ee5c0ab

                                                                            SHA1

                                                                            117d848bd407485aff8d2057d5cfad3e422b7aaa

                                                                            SHA256

                                                                            6586be940b0b64354e5313af8d8f3438c745e22bf231c5e126a4d3b88c1b5ab2

                                                                            SHA512

                                                                            261b8d24547f08410aabc85c0b7d13a5a472fecf3baf930360899f6494d15087bbfb44216a3a96029c1fdd12f6f10ce257a629c985b703eb5cabd1da83a2ce52

                                                                          • memory/1712-190-0x0000000074021000-0x0000000074023000-memory.dmp

                                                                            Filesize

                                                                            8KB

                                                                          • memory/1712-117-0x0000000075771000-0x0000000075773000-memory.dmp

                                                                            Filesize

                                                                            8KB