Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 17:29

General

  • Target

    a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe

  • Size

    72KB

  • MD5

    0679afb5dee70927aba930dc1899e776

  • SHA1

    d95dc0fa4e60eb1dcbb0dc97eddea63da7563277

  • SHA256

    a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5

  • SHA512

    9cd420b699eefd7833ac08d77fbdc6a453c080745619dbdea407d48fb607e5c9b90b00ab301df1e756d4af1e4cf9215bf6b2208c55f755f241f0a2406d8c7b2d

  • SSDEEP

    768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyvUow:HeT7BVwxfvqguKRFAbP

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 62 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe
    "C:\Users\Admin\AppData\Local\Temp\a4bfcb738a0ccdb3efd1b5596821bd656bb9d901b6b30b5949bbd6bf946b1fb5.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1620
    • C:\Users\Admin\AppData\Local\Temp\839000494\backup.exe
      C:\Users\Admin\AppData\Local\Temp\839000494\backup.exe C:\Users\Admin\AppData\Local\Temp\839000494\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:108
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:808
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1768
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1340
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:760
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1260
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1692
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1124
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1160
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:580
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1004
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1616
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:612
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1396
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1272
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:976
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1796
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:964
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:752
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:840
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:888
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1828
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1412
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1760
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:536
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:860
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1476
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1928
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\data.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                      PID:1484
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                      9⤵
                        PID:1956
                      • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                        9⤵
                          PID:1272
                      • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                        8⤵
                        • Executes dropped EXE
                        PID:1648
                      • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                        8⤵
                          PID:1996
                        • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                          8⤵
                            PID:1424
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:1892
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1888
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1016
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1784
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                            8⤵
                            • Executes dropped EXE
                            PID:1732
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                            8⤵
                              PID:1524
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                              8⤵
                                PID:2000
                            • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1336
                              • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                                8⤵
                                  PID:1680
                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                7⤵
                                  PID:988
                              • C:\Program Files\Common Files\Services\backup.exe
                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1744
                              • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                PID:1480
                                • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                  "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  PID:804
                              • C:\Program Files\Common Files\System\backup.exe
                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                6⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1516
                                • C:\Program Files\Common Files\System\ado\backup.exe
                                  "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:896
                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1976
                                  • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1260
                                  • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                    8⤵
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:276
                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1552
                                  • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                    "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                    8⤵
                                      PID:688
                                    • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                      8⤵
                                        PID:1772
                                    • C:\Program Files\Common Files\System\de-DE\update.exe
                                      "C:\Program Files\Common Files\System\de-DE\update.exe" C:\Program Files\Common Files\System\de-DE\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:1612
                                    • C:\Program Files\Common Files\System\en-US\backup.exe
                                      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                      7⤵
                                        PID:656
                                      • C:\Program Files\Common Files\System\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                        7⤵
                                          PID:892
                                        • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                          7⤵
                                            PID:1468
                                      • C:\Program Files\DVD Maker\backup.exe
                                        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                        5⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:1232
                                        • C:\Program Files\DVD Maker\de-DE\backup.exe
                                          "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:2008
                                        • C:\Program Files\DVD Maker\en-US\backup.exe
                                          "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1596
                                        • C:\Program Files\DVD Maker\es-ES\backup.exe
                                          "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1152
                                        • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                          "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1168
                                        • C:\Program Files\DVD Maker\it-IT\backup.exe
                                          "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:888
                                        • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                          "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1804
                                        • C:\Program Files\DVD Maker\Shared\backup.exe
                                          "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                          6⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1744
                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                            7⤵
                                              PID:1564
                                        • C:\Program Files\Google\backup.exe
                                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                          5⤵
                                          • Suspicious use of SetWindowsHookEx
                                          PID:1596
                                          • C:\Program Files\Google\Chrome\backup.exe
                                            "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                            6⤵
                                              PID:1368
                                          • C:\Program Files\Internet Explorer\backup.exe
                                            "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                            5⤵
                                              PID:1260
                                            • C:\Program Files\Java\backup.exe
                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                              5⤵
                                                PID:1592
                                            • C:\Program Files (x86)\update.exe
                                              "C:\Program Files (x86)\update.exe" C:\Program Files (x86)\
                                              4⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              • System policy modification
                                              PID:708
                                              • C:\Program Files (x86)\Adobe\backup.exe
                                                "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                5⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:1020
                                                • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:1032
                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                    7⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1680
                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                    7⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1548
                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                      8⤵
                                                        PID:980
                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                        8⤵
                                                          PID:620
                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                        7⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Drops file in Program Files directory
                                                        PID:1588
                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                          8⤵
                                                            PID:368
                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                            8⤵
                                                              PID:288
                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                            7⤵
                                                              PID:1532
                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                          5⤵
                                                          • Executes dropped EXE
                                                          PID:804
                                                        • C:\Program Files (x86)\Google\backup.exe
                                                          "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                          5⤵
                                                            PID:1640
                                                          • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                            "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                            5⤵
                                                              PID:432
                                                          • C:\Users\backup.exe
                                                            C:\Users\backup.exe C:\Users\
                                                            4⤵
                                                              PID:1776
                                                            • C:\Windows\backup.exe
                                                              C:\Windows\backup.exe C:\Windows\
                                                              4⤵
                                                                PID:944
                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                            2⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1552
                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                            2⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1404
                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                            2⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:896
                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                            2⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:1796
                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe
                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                            2⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:620
                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                            C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                            2⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:1360

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • C:\PerfLogs\Admin\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • C:\PerfLogs\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • C:\PerfLogs\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • C:\Program Files\7-Zip\Lang\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          faa50fb5e8710b94a871adda37166669

                                                          SHA1

                                                          735ab0f2020fc03cdc126ba9eea8a10779034faa

                                                          SHA256

                                                          8d9fc0361bd0fe813aa31ce21be476c2423ebfdd22f07f0ee0eb7f40c063cc8f

                                                          SHA512

                                                          63e33ef502c4b10263523cc4362006095a4b568cb38fa5912956ca3d4a4eee78bdd3f359e263d77626d8ca6f6d9577b3831f06c97f41a3c3ed60e20a3449cb5c

                                                        • C:\Program Files\7-Zip\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • C:\Program Files\7-Zip\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4904ffd3ad1865009da7160a49a11b3c

                                                          SHA1

                                                          1d0342ffedbd7aff46151371aa14dc2c406edd7f

                                                          SHA256

                                                          a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e

                                                          SHA512

                                                          95029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4

                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4904ffd3ad1865009da7160a49a11b3c

                                                          SHA1

                                                          1d0342ffedbd7aff46151371aa14dc2c406edd7f

                                                          SHA256

                                                          a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e

                                                          SHA512

                                                          95029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4

                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          38e409e2cf6c09238410a5e4feced2a4

                                                          SHA1

                                                          f5853d7fd4d718c571cdfa334cd49c37bfb7f448

                                                          SHA256

                                                          f8b6d5e7312d717560fccd865644d39e8ac2791383151c70a94dc77e9358da78

                                                          SHA512

                                                          7250389e809ea1bfa387dd29369b6f49697054ae7769bbfc70649875adb2f25fa5e1d67222294f97be9418b2b032841ab8006e8a20420675c636d8cc03d6f0fe

                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          47bd4736a1da2761bee5365a5e1546e3

                                                          SHA1

                                                          afa85396ff9d54d2bf5060df185c938ea4d57b5b

                                                          SHA256

                                                          75a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e

                                                          SHA512

                                                          57333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac

                                                        • C:\Program Files\Common Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          5dfa3dd6a6666a8841dae4f56d144c8b

                                                          SHA1

                                                          761b27daec0f7df79776c81d1252b1bca04a845a

                                                          SHA256

                                                          8eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b

                                                          SHA512

                                                          f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9

                                                        • C:\Program Files\Common Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          5dfa3dd6a6666a8841dae4f56d144c8b

                                                          SHA1

                                                          761b27daec0f7df79776c81d1252b1bca04a845a

                                                          SHA256

                                                          8eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b

                                                          SHA512

                                                          f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9

                                                        • C:\Program Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • C:\Program Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • C:\Users\Admin\AppData\Local\Temp\839000494\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • C:\Users\Admin\AppData\Local\Temp\839000494\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • C:\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          09ce44ec7fdd1070f5eb05def95d1d49

                                                          SHA1

                                                          0e73f461f5e00ba6b56e4e43db553294711ec020

                                                          SHA256

                                                          98a108d0f658ff34face6dcee3be6c2b014b35fb53221503c0c207092a091284

                                                          SHA512

                                                          eed9aba7b945c3fb9bf5af15b14ff5e6c678924ea76d4be878b0dee40ec4c18474198dbced4cdede202a4522282e8505934e7aa868244fa62fb42928d8014b2b

                                                        • C:\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          09ce44ec7fdd1070f5eb05def95d1d49

                                                          SHA1

                                                          0e73f461f5e00ba6b56e4e43db553294711ec020

                                                          SHA256

                                                          98a108d0f658ff34face6dcee3be6c2b014b35fb53221503c0c207092a091284

                                                          SHA512

                                                          eed9aba7b945c3fb9bf5af15b14ff5e6c678924ea76d4be878b0dee40ec4c18474198dbced4cdede202a4522282e8505934e7aa868244fa62fb42928d8014b2b

                                                        • \PerfLogs\Admin\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • \PerfLogs\Admin\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • \PerfLogs\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • \PerfLogs\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • \Program Files\7-Zip\Lang\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          faa50fb5e8710b94a871adda37166669

                                                          SHA1

                                                          735ab0f2020fc03cdc126ba9eea8a10779034faa

                                                          SHA256

                                                          8d9fc0361bd0fe813aa31ce21be476c2423ebfdd22f07f0ee0eb7f40c063cc8f

                                                          SHA512

                                                          63e33ef502c4b10263523cc4362006095a4b568cb38fa5912956ca3d4a4eee78bdd3f359e263d77626d8ca6f6d9577b3831f06c97f41a3c3ed60e20a3449cb5c

                                                        • \Program Files\7-Zip\Lang\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          faa50fb5e8710b94a871adda37166669

                                                          SHA1

                                                          735ab0f2020fc03cdc126ba9eea8a10779034faa

                                                          SHA256

                                                          8d9fc0361bd0fe813aa31ce21be476c2423ebfdd22f07f0ee0eb7f40c063cc8f

                                                          SHA512

                                                          63e33ef502c4b10263523cc4362006095a4b568cb38fa5912956ca3d4a4eee78bdd3f359e263d77626d8ca6f6d9577b3831f06c97f41a3c3ed60e20a3449cb5c

                                                        • \Program Files\7-Zip\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • \Program Files\7-Zip\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          7a6b6048bd17f2f03782ea4f78349f5a

                                                          SHA1

                                                          eafa0926a92b9438c6812342aae93df0bae53913

                                                          SHA256

                                                          8014fa2a1287e61e458f0114d68fea33eeaac6be2473ae275a0523fa27fcd08d

                                                          SHA512

                                                          3ba82f9f35642a0ef94f6daf15b240ef0fde4be9ca1b71bb1748ce570454ecea40e07f2993a1b57967774310fef9b670aa88246786baa1ea2925cb9357f75548

                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4904ffd3ad1865009da7160a49a11b3c

                                                          SHA1

                                                          1d0342ffedbd7aff46151371aa14dc2c406edd7f

                                                          SHA256

                                                          a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e

                                                          SHA512

                                                          95029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4

                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4904ffd3ad1865009da7160a49a11b3c

                                                          SHA1

                                                          1d0342ffedbd7aff46151371aa14dc2c406edd7f

                                                          SHA256

                                                          a5f2496d505b4c683ab7cb645c70e6c97b886b4baedaa764674ac10fbfe7a09e

                                                          SHA512

                                                          95029ae4c396fe42a0fb9f9c31dd5b82834f2113ad17b634bd57286e35f0186f61125dcb5557b8fc097f5ab0b5d21a36aca715c88e8dc39b7b0b478e57af09b4

                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          38e409e2cf6c09238410a5e4feced2a4

                                                          SHA1

                                                          f5853d7fd4d718c571cdfa334cd49c37bfb7f448

                                                          SHA256

                                                          f8b6d5e7312d717560fccd865644d39e8ac2791383151c70a94dc77e9358da78

                                                          SHA512

                                                          7250389e809ea1bfa387dd29369b6f49697054ae7769bbfc70649875adb2f25fa5e1d67222294f97be9418b2b032841ab8006e8a20420675c636d8cc03d6f0fe

                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          38e409e2cf6c09238410a5e4feced2a4

                                                          SHA1

                                                          f5853d7fd4d718c571cdfa334cd49c37bfb7f448

                                                          SHA256

                                                          f8b6d5e7312d717560fccd865644d39e8ac2791383151c70a94dc77e9358da78

                                                          SHA512

                                                          7250389e809ea1bfa387dd29369b6f49697054ae7769bbfc70649875adb2f25fa5e1d67222294f97be9418b2b032841ab8006e8a20420675c636d8cc03d6f0fe

                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          162c84c7a4ce86d0638661fa01b2f74b

                                                          SHA1

                                                          077de51ce9d885fbb6f14595643a7d03d9809b4f

                                                          SHA256

                                                          35a1600afd98548d6df1f5e8d473d783910677753cfdf041e4f438c936a9799f

                                                          SHA512

                                                          f6abd859c8413bf0c975ee56b874535ec70326aef8de1db2684a3a366cc737dcacf24b49c19c9fe2785fc54e2073ca5cc9117b797bebb31a9af2b2fbbe7d77fd

                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          47bd4736a1da2761bee5365a5e1546e3

                                                          SHA1

                                                          afa85396ff9d54d2bf5060df185c938ea4d57b5b

                                                          SHA256

                                                          75a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e

                                                          SHA512

                                                          57333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac

                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          47bd4736a1da2761bee5365a5e1546e3

                                                          SHA1

                                                          afa85396ff9d54d2bf5060df185c938ea4d57b5b

                                                          SHA256

                                                          75a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e

                                                          SHA512

                                                          57333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac

                                                        • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          47bd4736a1da2761bee5365a5e1546e3

                                                          SHA1

                                                          afa85396ff9d54d2bf5060df185c938ea4d57b5b

                                                          SHA256

                                                          75a25a1cf3f05ab3396d8d0033e7b60311e239ccfe9bf6f9cc265ca04061098e

                                                          SHA512

                                                          57333a9ab5dbcee3d65e11e662329a22dd65bb222a68ff16db5053e6c79406ed68f34b784fd33b719b682d595a910db5ef913c2e169ce50d87896f0d509865ac

                                                        • \Program Files\Common Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          5dfa3dd6a6666a8841dae4f56d144c8b

                                                          SHA1

                                                          761b27daec0f7df79776c81d1252b1bca04a845a

                                                          SHA256

                                                          8eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b

                                                          SHA512

                                                          f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9

                                                        • \Program Files\Common Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          5dfa3dd6a6666a8841dae4f56d144c8b

                                                          SHA1

                                                          761b27daec0f7df79776c81d1252b1bca04a845a

                                                          SHA256

                                                          8eaad21b77e199fa32318a4d76dd8ff6572da01427b225b4e0ca798ae38a8e8b

                                                          SHA512

                                                          f12cc6de028dba400e1e4737dd004761900221e268047674defc5e53cb93d1a27b155c6ea99a98d9acb7852d501e2067d461b3665be62794d20a54822b6325f9

                                                        • \Program Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • \Program Files\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          bc5bc052d95c7e9b36778b8c7d9649d0

                                                          SHA1

                                                          caf08892c892ec485576596f718549f111fcdc7f

                                                          SHA256

                                                          18b2fba772a38b4f6f896d19019f90c521ef731e40112ae84306fe359750e8c8

                                                          SHA512

                                                          7642b2ed08fd382d8c828f3999f6c4ebc2810f6a173126443a48726cf419fc30c41b6419ca3113eda467a1f34e2bcf5947f7382891b720c48a1b6167ecdcc2de

                                                        • \Users\Admin\AppData\Local\Temp\839000494\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\839000494\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          b66366e028d942eef45c07ff8df4fc4a

                                                          SHA1

                                                          ce25f06436692b2f4c2e23b5101194b932989918

                                                          SHA256

                                                          b5007d5da4df39ae19a0e92d5e59d9a70eba2a4ce1e7a1b4f14919dd6b8d748d

                                                          SHA512

                                                          4e736e33d364ced25ed120f5ad2624b9390be9c20c7449470568e58e71aaef9ef12f9d9539638413f241e291326ce5bb93b69cfd6f0caafa473d37e086728470

                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                          Filesize

                                                          72KB

                                                          MD5

                                                          4351ed79f6e2b4d031e7238a7cb7b193

                                                          SHA1

                                                          5f3f2732382686eac64f9281de672849b9fce4a1

                                                          SHA256

                                                          b6d17d3b919d32b39da60d31be2302bfcbcf635388364ecfc4039ae08be67b11

                                                          SHA512

                                                          99eb4ff836b86a9ada5d52ddbc199935fe40b764d330d64d849de1ae609a0cd60b03f8a1034c3aeb74b6cba3f51709b04526c5884aeeb4aee051802eab43b439

                                                        • memory/620-144-0x0000000075501000-0x0000000075503000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/1620-222-0x0000000074261000-0x0000000074263000-memory.dmp

                                                          Filesize

                                                          8KB