Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 17:32

General

  • Target

    ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe

  • Size

    72KB

  • MD5

    0f135b6d9d3400dc892ded47e4af3fdb

  • SHA1

    3b81b96090e86430389e09ada825316fa567a4d8

  • SHA256

    ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c

  • SHA512

    4296b8d55aaf3de00beaf690c9f713ebe78c55c6af5d712c12f3ce6f0698d3c1674910a0dda72825939dc570f8848c707dfe1fbc142d19367d9bca257dc3a2f3

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2d:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrh

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe
    "C:\Users\Admin\AppData\Local\Temp\ec6510659182a8ecd17196811cec7306287c6ec83bf82b51415a93dced99392c.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\485290244\backup.exe
      C:\Users\Admin\AppData\Local\Temp\485290244\backup.exe C:\Users\Admin\AppData\Local\Temp\485290244\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:952
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:868
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:972
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1712
        • C:\Program Files\data.exe
          "C:\Program Files\data.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1528
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1472
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1736
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:612
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:108
              • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1616
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1684
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1676
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1348
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1048
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:436
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:596
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1680
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:676
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:588
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1148
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1352
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:320
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1720
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1768
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1924
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1776
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1828
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1004
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1524
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1112
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1868
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1456
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1700
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:584
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:996
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:824
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1628
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1672
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:588
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:580
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  PID:1528
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                    PID:584
                  • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1072
                  • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1812
                  • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:776
                  • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:1548
                  • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1324
                  • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:1456
                  • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:1972
                  • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:1824
                  • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                    8⤵
                      PID:580
                    • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                      8⤵
                        PID:1604
                      • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                        8⤵
                          PID:588
                        • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                          8⤵
                            PID:2172
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          PID:1284
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:768
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                            8⤵
                              PID:1324
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                              8⤵
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1688
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:1656
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                              8⤵
                              • System policy modification
                              PID:1844
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                              8⤵
                                PID:1980
                            • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:804
                              • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                                8⤵
                                  PID:1068
                              • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                7⤵
                                  PID:1124
                                • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                  7⤵
                                    PID:976
                                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                    7⤵
                                      PID:1112
                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                      7⤵
                                        PID:2088
                                    • C:\Program Files\Common Files\Services\backup.exe
                                      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1692
                                    • C:\Program Files\Common Files\SpeechEngines\update.exe
                                      "C:\Program Files\Common Files\SpeechEngines\update.exe" C:\Program Files\Common Files\SpeechEngines\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1580
                                      • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:1068
                                    • C:\Program Files\Common Files\System\backup.exe
                                      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:784
                                      • C:\Program Files\Common Files\System\ado\backup.exe
                                        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Drops file in Program Files directory
                                        • System policy modification
                                        PID:968
                                        • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System policy modification
                                          PID:1604
                                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                          8⤵
                                          • System policy modification
                                          PID:1048
                                        • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                          "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                          8⤵
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:1564
                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          PID:1320
                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                          8⤵
                                          • System policy modification
                                          PID:692
                                        • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                          "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System policy modification
                                          PID:1620
                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        PID:1348
                                      • C:\Program Files\Common Files\System\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                        7⤵
                                          PID:1412
                                        • C:\Program Files\Common Files\System\es-ES\backup.exe
                                          "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                          7⤵
                                            PID:972
                                          • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                            7⤵
                                              PID:1284
                                            • C:\Program Files\Common Files\System\it-IT\backup.exe
                                              "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                              7⤵
                                                PID:1476
                                              • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                7⤵
                                                  PID:2156
                                            • C:\Program Files\DVD Maker\backup.exe
                                              "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                              5⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Executes dropped EXE
                                              • Drops file in Program Files directory
                                              • Suspicious use of SetWindowsHookEx
                                              PID:1588
                                              • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                6⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:556
                                              • C:\Program Files\DVD Maker\en-US\backup.exe
                                                "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                6⤵
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                PID:1252
                                              • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:268
                                              • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                PID:320
                                              • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                PID:284
                                              • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:1684
                                              • C:\Program Files\DVD Maker\Shared\update.exe
                                                "C:\Program Files\DVD Maker\Shared\update.exe" C:\Program Files\DVD Maker\Shared\
                                                6⤵
                                                • Drops file in Program Files directory
                                                PID:280
                                                • C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe
                                                  "C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                  7⤵
                                                  • Disables RegEdit via registry modification
                                                  • Drops file in Program Files directory
                                                  • System policy modification
                                                  PID:1384
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\update.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:1944
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • System policy modification
                                                    PID:1712
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                    8⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:1296
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
                                                    8⤵
                                                      PID:1084
                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
                                                      8⤵
                                                        PID:1556
                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
                                                        8⤵
                                                          PID:1620
                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe
                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
                                                          8⤵
                                                            PID:1536
                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
                                                            8⤵
                                                              PID:2188
                                                      • C:\Program Files\Google\backup.exe
                                                        "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                        5⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • System policy modification
                                                        PID:1524
                                                        • C:\Program Files\Google\Chrome\backup.exe
                                                          "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                          6⤵
                                                            PID:776
                                                            • C:\Program Files\Google\Chrome\Application\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                              7⤵
                                                                PID:772
                                                          • C:\Program Files\Internet Explorer\data.exe
                                                            "C:\Program Files\Internet Explorer\data.exe" C:\Program Files\Internet Explorer\
                                                            5⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • System policy modification
                                                            PID:928
                                                            • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                              "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                              6⤵
                                                                PID:984
                                                              • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                6⤵
                                                                  PID:988
                                                                • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                  "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                  6⤵
                                                                    PID:584
                                                                  • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                    "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                    6⤵
                                                                      PID:1612
                                                                    • C:\Program Files\Internet Explorer\images\backup.exe
                                                                      "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                      6⤵
                                                                        PID:2212
                                                                    • C:\Program Files\Java\backup.exe
                                                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                      5⤵
                                                                        PID:1944
                                                                        • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                                          "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                                          6⤵
                                                                            PID:2108
                                                                        • C:\Program Files\Microsoft Games\backup.exe
                                                                          "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                          5⤵
                                                                            PID:1560
                                                                          • C:\Program Files\Microsoft Office\backup.exe
                                                                            "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                            5⤵
                                                                              PID:968
                                                                            • C:\Program Files\Mozilla Firefox\update.exe
                                                                              "C:\Program Files\Mozilla Firefox\update.exe" C:\Program Files\Mozilla Firefox\
                                                                              5⤵
                                                                                PID:2128
                                                                            • C:\Program Files (x86)\backup.exe
                                                                              "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                              4⤵
                                                                              • Executes dropped EXE
                                                                              • Drops file in Program Files directory
                                                                              • Suspicious use of SetWindowsHookEx
                                                                              PID:872
                                                                              • C:\Program Files (x86)\Adobe\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                5⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Program Files directory
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                • System policy modification
                                                                                PID:1592
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                  6⤵
                                                                                  • Executes dropped EXE
                                                                                  • Drops file in Program Files directory
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:700
                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1800
                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                    7⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Drops file in Program Files directory
                                                                                    • System policy modification
                                                                                    PID:688
                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe
                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                      8⤵
                                                                                        PID:1972
                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                        8⤵
                                                                                          PID:1696
                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                          8⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • System policy modification
                                                                                          PID:1124
                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                          8⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Drops file in Program Files directory
                                                                                          PID:1536
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                            9⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Disables RegEdit via registry modification
                                                                                            • System policy modification
                                                                                            PID:1768
                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                          8⤵
                                                                                            PID:1776
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            PID:1112
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                              9⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • System policy modification
                                                                                              PID:1240
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                            8⤵
                                                                                            • Disables RegEdit via registry modification
                                                                                            • System policy modification
                                                                                            PID:1812
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                            8⤵
                                                                                              PID:1252
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                              8⤵
                                                                                                PID:560
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                8⤵
                                                                                                  PID:1736
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                  8⤵
                                                                                                    PID:2052
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                  7⤵
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Drops file in Program Files directory
                                                                                                  • System policy modification
                                                                                                  PID:1844
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                    8⤵
                                                                                                      PID:1768
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                                      8⤵
                                                                                                        PID:2040
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
                                                                                                        8⤵
                                                                                                          PID:1712
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
                                                                                                          8⤵
                                                                                                            PID:2068
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
                                                                                                            8⤵
                                                                                                              PID:2204
                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                            7⤵
                                                                                                              PID:1756
                                                                                                        • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                          "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                          5⤵
                                                                                                          • Disables RegEdit via registry modification
                                                                                                          • Drops file in Program Files directory
                                                                                                          PID:1336
                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\System Restore.exe
                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                            6⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            • Drops file in Program Files directory
                                                                                                            • System policy modification
                                                                                                            PID:472
                                                                                                            • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                                                                              "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                              7⤵
                                                                                                                PID:1784
                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                                7⤵
                                                                                                                  PID:304
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                                                  7⤵
                                                                                                                    PID:2120
                                                                                                                • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                  "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                  6⤵
                                                                                                                    PID:1656
                                                                                                                  • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                                                    "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                    6⤵
                                                                                                                      PID:1812
                                                                                                                    • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                      "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                      6⤵
                                                                                                                        PID:2096
                                                                                                                    • C:\Program Files (x86)\Google\backup.exe
                                                                                                                      "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                      5⤵
                                                                                                                        PID:1548
                                                                                                                      • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                        "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                        5⤵
                                                                                                                          PID:524
                                                                                                                        • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                          5⤵
                                                                                                                            PID:2060
                                                                                                                          • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                            5⤵
                                                                                                                              PID:2196
                                                                                                                          • C:\Users\backup.exe
                                                                                                                            C:\Users\backup.exe C:\Users\
                                                                                                                            4⤵
                                                                                                                              PID:1700
                                                                                                                              • C:\Users\Admin\backup.exe
                                                                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                5⤵
                                                                                                                                  PID:572
                                                                                                                                  • C:\Users\Admin\Contacts\data.exe
                                                                                                                                    C:\Users\Admin\Contacts\data.exe C:\Users\Admin\Contacts\
                                                                                                                                    6⤵
                                                                                                                                      PID:1172
                                                                                                                                    • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                      C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                      6⤵
                                                                                                                                        PID:2164
                                                                                                                                    • C:\Users\Public\backup.exe
                                                                                                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                      5⤵
                                                                                                                                        PID:1212
                                                                                                                                        • C:\Users\Public\Documents\data.exe
                                                                                                                                          C:\Users\Public\Documents\data.exe C:\Users\Public\Documents\
                                                                                                                                          6⤵
                                                                                                                                            PID:1776
                                                                                                                                          • C:\Users\Public\Downloads\data.exe
                                                                                                                                            C:\Users\Public\Downloads\data.exe C:\Users\Public\Downloads\
                                                                                                                                            6⤵
                                                                                                                                              PID:2148
                                                                                                                                        • C:\Windows\backup.exe
                                                                                                                                          C:\Windows\backup.exe C:\Windows\
                                                                                                                                          4⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:276
                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                            5⤵
                                                                                                                                              PID:1516
                                                                                                                                            • C:\Windows\AppCompat\backup.exe
                                                                                                                                              C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                              5⤵
                                                                                                                                                PID:2004
                                                                                                                                              • C:\Windows\AppPatch\backup.exe
                                                                                                                                                C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                                5⤵
                                                                                                                                                  PID:1328
                                                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2180
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                              2⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              • System policy modification
                                                                                                                                              PID:1692
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\update.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\Low\update.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Loads dropped DLL
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1512
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1980
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                              2⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:1340
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                              2⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              PID:700
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                              2⤵
                                                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                              • System policy modification
                                                                                                                                              PID:1380

                                                                                                                                          Network

                                                                                                                                          MITRE ATT&CK Enterprise v6

                                                                                                                                          Replay Monitor

                                                                                                                                          Loading Replay Monitor...

                                                                                                                                          Downloads

                                                                                                                                          • C:\PerfLogs\Admin\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            2955fa58c0f9b8f743bede4df9785d08

                                                                                                                                            SHA1

                                                                                                                                            c2393d547255449a0596022e94811bd6eca143e6

                                                                                                                                            SHA256

                                                                                                                                            10e1c417dfa365c61a3fd0c8031ce633dbc7d1e56af3d9d515a24e7abbc81b36

                                                                                                                                            SHA512

                                                                                                                                            113b6d205b4f753c77cfce882211554ec8fc4b2435c0ec28cc8c4a26b94b812a9f94a2470e92c1a15bf963084d5208e1c8e6781da55a20c02921ae7b3771f4ff

                                                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            707a61cf2ed77e9f65caaf67155bf6cb

                                                                                                                                            SHA1

                                                                                                                                            2960c8c96a7a83d83aaf149d91d043f1fa3f3d23

                                                                                                                                            SHA256

                                                                                                                                            ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6

                                                                                                                                            SHA512

                                                                                                                                            472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc

                                                                                                                                          • C:\PerfLogs\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            707a61cf2ed77e9f65caaf67155bf6cb

                                                                                                                                            SHA1

                                                                                                                                            2960c8c96a7a83d83aaf149d91d043f1fa3f3d23

                                                                                                                                            SHA256

                                                                                                                                            ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6

                                                                                                                                            SHA512

                                                                                                                                            472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc

                                                                                                                                          • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            ce499c73d771a9ab0876658b34ad60c3

                                                                                                                                            SHA1

                                                                                                                                            011da82531eab338f3155da219f3cc110fc5ac7d

                                                                                                                                            SHA256

                                                                                                                                            3320f93de0a05b3c7b37a4b1aef312af4c03ced24c7fa8e5b22b8d51c838b7c0

                                                                                                                                            SHA512

                                                                                                                                            9345a0f39b359f05d2ebdc7956e7a1e7f274f7e63fc8e683a8210548d557897fa0cec60eb9c4935fa84c05d9f6e825f5880bbdec6489ecfc0b9d326de8c12537

                                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            1b6f46fc093a2e08b642464d1c732102

                                                                                                                                            SHA1

                                                                                                                                            7f181a8b349d7ce24d84da17feab867d76abbc26

                                                                                                                                            SHA256

                                                                                                                                            bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92

                                                                                                                                            SHA512

                                                                                                                                            f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef

                                                                                                                                          • C:\Program Files\7-Zip\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            1b6f46fc093a2e08b642464d1c732102

                                                                                                                                            SHA1

                                                                                                                                            7f181a8b349d7ce24d84da17feab867d76abbc26

                                                                                                                                            SHA256

                                                                                                                                            bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92

                                                                                                                                            SHA512

                                                                                                                                            f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            cb57fa41e031000b16a5b2bf6e86fe51

                                                                                                                                            SHA1

                                                                                                                                            8967e5957e323818d849390c94d14a1ef883aa33

                                                                                                                                            SHA256

                                                                                                                                            a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13

                                                                                                                                            SHA512

                                                                                                                                            b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            cb57fa41e031000b16a5b2bf6e86fe51

                                                                                                                                            SHA1

                                                                                                                                            8967e5957e323818d849390c94d14a1ef883aa33

                                                                                                                                            SHA256

                                                                                                                                            a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13

                                                                                                                                            SHA512

                                                                                                                                            b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            ea9999892d76fa5ec2c8a0e77d244ba2

                                                                                                                                            SHA1

                                                                                                                                            7a68f34277b5e37d7c6d79561c9ee0f9f7b71c31

                                                                                                                                            SHA256

                                                                                                                                            0c3111ee249a5ae4e51db9aa1b00ded8e22a730447ff7c43aaf2720801e240e0

                                                                                                                                            SHA512

                                                                                                                                            24ee60f5dd4bd3ac864f9fd4925ff7c3853a4f0367f8fe17ba868a0a7a0f5d4574ad783855675461927c45c12fe14c5e186afc920e9fff20bc2367fdf2e46471

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            0028bbfcf7e8c7f992161a365a214dcf

                                                                                                                                            SHA1

                                                                                                                                            f7605cb3394fc71c1c2ecceb6ff676649a9b37a7

                                                                                                                                            SHA256

                                                                                                                                            0c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1

                                                                                                                                            SHA512

                                                                                                                                            527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf

                                                                                                                                          • C:\Program Files\Common Files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            0028bbfcf7e8c7f992161a365a214dcf

                                                                                                                                            SHA1

                                                                                                                                            f7605cb3394fc71c1c2ecceb6ff676649a9b37a7

                                                                                                                                            SHA256

                                                                                                                                            0c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1

                                                                                                                                            SHA512

                                                                                                                                            527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf

                                                                                                                                          • C:\Program Files\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            73fa53182e7ee0e965931b37651caf74

                                                                                                                                            SHA1

                                                                                                                                            c781dbb44f634bce39344c984f9b60f6d400ac55

                                                                                                                                            SHA256

                                                                                                                                            53e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997

                                                                                                                                            SHA512

                                                                                                                                            80191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a

                                                                                                                                          • C:\Program Files\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            73fa53182e7ee0e965931b37651caf74

                                                                                                                                            SHA1

                                                                                                                                            c781dbb44f634bce39344c984f9b60f6d400ac55

                                                                                                                                            SHA256

                                                                                                                                            53e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997

                                                                                                                                            SHA512

                                                                                                                                            80191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\485290244\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            768588b970e015c7b1d2b3b30bddda3a

                                                                                                                                            SHA1

                                                                                                                                            a1910572efe948d136eed5fc6cefbdcf158fc0ea

                                                                                                                                            SHA256

                                                                                                                                            ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6

                                                                                                                                            SHA512

                                                                                                                                            71f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\485290244\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            768588b970e015c7b1d2b3b30bddda3a

                                                                                                                                            SHA1

                                                                                                                                            a1910572efe948d136eed5fc6cefbdcf158fc0ea

                                                                                                                                            SHA256

                                                                                                                                            ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6

                                                                                                                                            SHA512

                                                                                                                                            71f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            d1ef689557d681b6aa855509204a568d

                                                                                                                                            SHA1

                                                                                                                                            a9c9190f19b912390e43bf8274ac50874504e69c

                                                                                                                                            SHA256

                                                                                                                                            70bfe9f16b7600afe2bc4a90cd147b777a19b1d874510f730dfbc74f3d5991ac

                                                                                                                                            SHA512

                                                                                                                                            1745552b9125135a738daa56bf1211f562a42356bebecf0078e0facaf466ea251401ec23e50540a8e3c6f600695cbaa79510e524aa3df733ceabee970b25939c

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • C:\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e01b4c688d0aece3fa4912ad7bca7158

                                                                                                                                            SHA1

                                                                                                                                            27e8b5f29c4260b0f937c345281497d77bbe37db

                                                                                                                                            SHA256

                                                                                                                                            fc0f8bd2856c5b30a8ccf0e861101a27c27a9fcf8dbb130dc1462b207e74974e

                                                                                                                                            SHA512

                                                                                                                                            825c6aa95d60f9b66dc5cbcc1f0e7433d205e0de767b01acea365879b3f46efbda85efe666c083b155b89dfbadf4786b6b1cfc32d18255120aaf3690a2e88665

                                                                                                                                          • C:\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e01b4c688d0aece3fa4912ad7bca7158

                                                                                                                                            SHA1

                                                                                                                                            27e8b5f29c4260b0f937c345281497d77bbe37db

                                                                                                                                            SHA256

                                                                                                                                            fc0f8bd2856c5b30a8ccf0e861101a27c27a9fcf8dbb130dc1462b207e74974e

                                                                                                                                            SHA512

                                                                                                                                            825c6aa95d60f9b66dc5cbcc1f0e7433d205e0de767b01acea365879b3f46efbda85efe666c083b155b89dfbadf4786b6b1cfc32d18255120aaf3690a2e88665

                                                                                                                                          • \PerfLogs\Admin\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            2955fa58c0f9b8f743bede4df9785d08

                                                                                                                                            SHA1

                                                                                                                                            c2393d547255449a0596022e94811bd6eca143e6

                                                                                                                                            SHA256

                                                                                                                                            10e1c417dfa365c61a3fd0c8031ce633dbc7d1e56af3d9d515a24e7abbc81b36

                                                                                                                                            SHA512

                                                                                                                                            113b6d205b4f753c77cfce882211554ec8fc4b2435c0ec28cc8c4a26b94b812a9f94a2470e92c1a15bf963084d5208e1c8e6781da55a20c02921ae7b3771f4ff

                                                                                                                                          • \PerfLogs\Admin\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            2955fa58c0f9b8f743bede4df9785d08

                                                                                                                                            SHA1

                                                                                                                                            c2393d547255449a0596022e94811bd6eca143e6

                                                                                                                                            SHA256

                                                                                                                                            10e1c417dfa365c61a3fd0c8031ce633dbc7d1e56af3d9d515a24e7abbc81b36

                                                                                                                                            SHA512

                                                                                                                                            113b6d205b4f753c77cfce882211554ec8fc4b2435c0ec28cc8c4a26b94b812a9f94a2470e92c1a15bf963084d5208e1c8e6781da55a20c02921ae7b3771f4ff

                                                                                                                                          • \PerfLogs\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            707a61cf2ed77e9f65caaf67155bf6cb

                                                                                                                                            SHA1

                                                                                                                                            2960c8c96a7a83d83aaf149d91d043f1fa3f3d23

                                                                                                                                            SHA256

                                                                                                                                            ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6

                                                                                                                                            SHA512

                                                                                                                                            472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc

                                                                                                                                          • \PerfLogs\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            707a61cf2ed77e9f65caaf67155bf6cb

                                                                                                                                            SHA1

                                                                                                                                            2960c8c96a7a83d83aaf149d91d043f1fa3f3d23

                                                                                                                                            SHA256

                                                                                                                                            ff678ec0f240e53f3091557e1031860c061069952660e82c76e0f79a8b2ffbe6

                                                                                                                                            SHA512

                                                                                                                                            472676487246a467ef3b4a54e43ab8e9cf4c1f2b908f868d6e751807fb54d8fbddcf7d1ac155d049b3ddb3d73b98c6d5f4ea77a53d86e98536ebdb75695e90dc

                                                                                                                                          • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            ce499c73d771a9ab0876658b34ad60c3

                                                                                                                                            SHA1

                                                                                                                                            011da82531eab338f3155da219f3cc110fc5ac7d

                                                                                                                                            SHA256

                                                                                                                                            3320f93de0a05b3c7b37a4b1aef312af4c03ced24c7fa8e5b22b8d51c838b7c0

                                                                                                                                            SHA512

                                                                                                                                            9345a0f39b359f05d2ebdc7956e7a1e7f274f7e63fc8e683a8210548d557897fa0cec60eb9c4935fa84c05d9f6e825f5880bbdec6489ecfc0b9d326de8c12537

                                                                                                                                          • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            ce499c73d771a9ab0876658b34ad60c3

                                                                                                                                            SHA1

                                                                                                                                            011da82531eab338f3155da219f3cc110fc5ac7d

                                                                                                                                            SHA256

                                                                                                                                            3320f93de0a05b3c7b37a4b1aef312af4c03ced24c7fa8e5b22b8d51c838b7c0

                                                                                                                                            SHA512

                                                                                                                                            9345a0f39b359f05d2ebdc7956e7a1e7f274f7e63fc8e683a8210548d557897fa0cec60eb9c4935fa84c05d9f6e825f5880bbdec6489ecfc0b9d326de8c12537

                                                                                                                                          • \Program Files\7-Zip\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            1b6f46fc093a2e08b642464d1c732102

                                                                                                                                            SHA1

                                                                                                                                            7f181a8b349d7ce24d84da17feab867d76abbc26

                                                                                                                                            SHA256

                                                                                                                                            bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92

                                                                                                                                            SHA512

                                                                                                                                            f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef

                                                                                                                                          • \Program Files\7-Zip\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            1b6f46fc093a2e08b642464d1c732102

                                                                                                                                            SHA1

                                                                                                                                            7f181a8b349d7ce24d84da17feab867d76abbc26

                                                                                                                                            SHA256

                                                                                                                                            bdca8fba54613434f882cb4834888856adfdc730949d93672f084044df5c8b92

                                                                                                                                            SHA512

                                                                                                                                            f2dca14df1aa23b1c58b9c79cb0692ff6a75ba07d6dbe1cd2151b77427b9f23f7b18cdf93954bf0c41cc04ce9b939bc75e6fee6e32fd6b538ab75fb64b9996ef

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            cb57fa41e031000b16a5b2bf6e86fe51

                                                                                                                                            SHA1

                                                                                                                                            8967e5957e323818d849390c94d14a1ef883aa33

                                                                                                                                            SHA256

                                                                                                                                            a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13

                                                                                                                                            SHA512

                                                                                                                                            b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            cb57fa41e031000b16a5b2bf6e86fe51

                                                                                                                                            SHA1

                                                                                                                                            8967e5957e323818d849390c94d14a1ef883aa33

                                                                                                                                            SHA256

                                                                                                                                            a747b8cb8e8351646ed191e9006accec93389bd53c905182fb1b29d487aacd13

                                                                                                                                            SHA512

                                                                                                                                            b21817e7ccc15ec66c1d0bded1cfa1833624f7d96d842b4a9bec5fc41189d95ef4360da3d4c04aaac584ed92f6028b243be1a4df6356cc642095703c5c8cfd12

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            ea9999892d76fa5ec2c8a0e77d244ba2

                                                                                                                                            SHA1

                                                                                                                                            7a68f34277b5e37d7c6d79561c9ee0f9f7b71c31

                                                                                                                                            SHA256

                                                                                                                                            0c3111ee249a5ae4e51db9aa1b00ded8e22a730447ff7c43aaf2720801e240e0

                                                                                                                                            SHA512

                                                                                                                                            24ee60f5dd4bd3ac864f9fd4925ff7c3853a4f0367f8fe17ba868a0a7a0f5d4574ad783855675461927c45c12fe14c5e186afc920e9fff20bc2367fdf2e46471

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            ea9999892d76fa5ec2c8a0e77d244ba2

                                                                                                                                            SHA1

                                                                                                                                            7a68f34277b5e37d7c6d79561c9ee0f9f7b71c31

                                                                                                                                            SHA256

                                                                                                                                            0c3111ee249a5ae4e51db9aa1b00ded8e22a730447ff7c43aaf2720801e240e0

                                                                                                                                            SHA512

                                                                                                                                            24ee60f5dd4bd3ac864f9fd4925ff7c3853a4f0367f8fe17ba868a0a7a0f5d4574ad783855675461927c45c12fe14c5e186afc920e9fff20bc2367fdf2e46471

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            31d6344cb7284902138ddc2311af631f

                                                                                                                                            SHA1

                                                                                                                                            27cc12938b567f9016f63722bbf6cbd323b79dcb

                                                                                                                                            SHA256

                                                                                                                                            f7f954254bf29f478513684671306be1a0dda89aafc20cd04f50ee3ab10f99f3

                                                                                                                                            SHA512

                                                                                                                                            20a02ebc167d0f607a3b5aefbdf93aff1ea4be4ef97f1710d72c5eb6459325c00e33d87d2460ebe156f48fc375650ee2f5bc31b2951684134c2162f92ec198c7

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • \Program Files\Common Files\Microsoft Shared\ink\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            b9dd7fe1d07c3d7f310e9311b55c6e7e

                                                                                                                                            SHA1

                                                                                                                                            d2c97f178a8507fc0ee1e3b6d73d1c97a2a1dd12

                                                                                                                                            SHA256

                                                                                                                                            df285f32e5b9ce3cc329b46d8ef3c1d84c8cf82d094c306adb98d30103646ffd

                                                                                                                                            SHA512

                                                                                                                                            ce91637693cd37831544a1c65e8a0d01d4fe3f577be222c015cf2ae3326412ffec861bcb2913b66c100d362cabbb876059a4e0ef1c6886a3a1efa7e714605ea6

                                                                                                                                          • \Program Files\Common Files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            0028bbfcf7e8c7f992161a365a214dcf

                                                                                                                                            SHA1

                                                                                                                                            f7605cb3394fc71c1c2ecceb6ff676649a9b37a7

                                                                                                                                            SHA256

                                                                                                                                            0c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1

                                                                                                                                            SHA512

                                                                                                                                            527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf

                                                                                                                                          • \Program Files\Common Files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            0028bbfcf7e8c7f992161a365a214dcf

                                                                                                                                            SHA1

                                                                                                                                            f7605cb3394fc71c1c2ecceb6ff676649a9b37a7

                                                                                                                                            SHA256

                                                                                                                                            0c21a4071bbebe1eb395ffe3224ac220adff8a302a6a331ffe20a09a109e6eb1

                                                                                                                                            SHA512

                                                                                                                                            527e7d5400b5c5c53f3d2b52399a0c68a01ef05f8a0be4ded8e2956557a6d7c6e577b93adfb22adf7f36439805c062c4055d9db9eed9fc6a78c5878400833aaf

                                                                                                                                          • \Program Files\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            73fa53182e7ee0e965931b37651caf74

                                                                                                                                            SHA1

                                                                                                                                            c781dbb44f634bce39344c984f9b60f6d400ac55

                                                                                                                                            SHA256

                                                                                                                                            53e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997

                                                                                                                                            SHA512

                                                                                                                                            80191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a

                                                                                                                                          • \Program Files\data.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            73fa53182e7ee0e965931b37651caf74

                                                                                                                                            SHA1

                                                                                                                                            c781dbb44f634bce39344c984f9b60f6d400ac55

                                                                                                                                            SHA256

                                                                                                                                            53e20aee12ca20576864ff2d88df80b633dc2b9499781c0b738fd52980bc0997

                                                                                                                                            SHA512

                                                                                                                                            80191c90c12228a1944d99e3a82129028f3c75fe35cd35369e5db810f5b3d2028652c276a9af63f209de8eda52fb19512fb10c24dd0579bc7a638f1b6e43d93a

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\485290244\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            768588b970e015c7b1d2b3b30bddda3a

                                                                                                                                            SHA1

                                                                                                                                            a1910572efe948d136eed5fc6cefbdcf158fc0ea

                                                                                                                                            SHA256

                                                                                                                                            ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6

                                                                                                                                            SHA512

                                                                                                                                            71f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\485290244\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            768588b970e015c7b1d2b3b30bddda3a

                                                                                                                                            SHA1

                                                                                                                                            a1910572efe948d136eed5fc6cefbdcf158fc0ea

                                                                                                                                            SHA256

                                                                                                                                            ef32d9ae799e20a8bedcf92aa7360c0875be15ce2853978a7be6ef22aa9f54c6

                                                                                                                                            SHA512

                                                                                                                                            71f76d87e05e0065aaf18bc8bb18bb94a9f9cd2f1ddba3b0be7b7395121a1cb84dc551b4592a894dca12ed1c9a8c90f80f861223c23a2f9d901cb40e55881e37

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Low\update.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            d1ef689557d681b6aa855509204a568d

                                                                                                                                            SHA1

                                                                                                                                            a9c9190f19b912390e43bf8274ac50874504e69c

                                                                                                                                            SHA256

                                                                                                                                            70bfe9f16b7600afe2bc4a90cd147b777a19b1d874510f730dfbc74f3d5991ac

                                                                                                                                            SHA512

                                                                                                                                            1745552b9125135a738daa56bf1211f562a42356bebecf0078e0facaf466ea251401ec23e50540a8e3c6f600695cbaa79510e524aa3df733ceabee970b25939c

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            d1ef689557d681b6aa855509204a568d

                                                                                                                                            SHA1

                                                                                                                                            a9c9190f19b912390e43bf8274ac50874504e69c

                                                                                                                                            SHA256

                                                                                                                                            70bfe9f16b7600afe2bc4a90cd147b777a19b1d874510f730dfbc74f3d5991ac

                                                                                                                                            SHA512

                                                                                                                                            1745552b9125135a738daa56bf1211f562a42356bebecf0078e0facaf466ea251401ec23e50540a8e3c6f600695cbaa79510e524aa3df733ceabee970b25939c

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                            Filesize

                                                                                                                                            72KB

                                                                                                                                            MD5

                                                                                                                                            e7654f4a2452beff6deb573954636703

                                                                                                                                            SHA1

                                                                                                                                            b22726e9e2d9c6710945216fd334960464c60c6a

                                                                                                                                            SHA256

                                                                                                                                            a3f991072d00b3eb9923e8d4014f69b7f83b18cb128606484ce093193cfc5653

                                                                                                                                            SHA512

                                                                                                                                            adf6a3c65864ad64f7ee08a3dcba99c3f78df4594e5c9b099faf599719c0688a80180fc12c945a9152d1426c3a749a44c737cf627e60963e815349218a335bf8

                                                                                                                                          • memory/1512-72-0x00000000751A1000-0x00000000751A3000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB

                                                                                                                                          • memory/1724-127-0x00000000744F1000-0x00000000744F3000-memory.dmp

                                                                                                                                            Filesize

                                                                                                                                            8KB