Analysis

  • max time kernel
    201s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    21/11/2022, 14:21 UTC

General

  • Target

    8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe

  • Size

    72KB

  • MD5

    11099deb0c163459ae1b42709ae56081

  • SHA1

    527f920ad7a37f678b1580721a3a352dbd5ccb2d

  • SHA256

    8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5

  • SHA512

    473d57b3844e1f6f64743934cdf4b065be0cefeb31677d4c69d721bea3e0ae1ceb52ddf615abe18869547bee7fc74c35f590d64d1f6237e5063d0d5d9edecb50

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2p:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP9

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe
    "C:\Users\Admin\AppData\Local\Temp\8c1bf8847a73f8926b3c19f8cd48d65c511841bb5997af612826979b5da92bb5.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1228
    • C:\Users\Admin\AppData\Local\Temp\3509248515\backup.exe
      C:\Users\Admin\AppData\Local\Temp\3509248515\backup.exe C:\Users\Admin\AppData\Local\Temp\3509248515\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2040
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1492
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1660
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1972
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1016
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1992
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:852
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:276
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1820
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1536
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:864
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1460
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:844
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:688
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1176
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1508
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1680
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:764
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2044
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1856
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1620
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1580
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1532
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1480
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1060
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:992
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1904
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:1480
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:848
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                      PID:1196
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                      9⤵
                        PID:1600
                      • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                        9⤵
                          PID:1972
                      • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                        8⤵
                          PID:432
                        • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                          8⤵
                            PID:1616
                          • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe
                            "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                            8⤵
                              PID:1344
                            • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                              8⤵
                                PID:2232
                            • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:240
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                                8⤵
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1432
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1720
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1116
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1540
                              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                                8⤵
                                  PID:1632
                                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                                  8⤵
                                    PID:1296
                                • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Drops file in Program Files directory
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1780
                                  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                                    8⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1828
                                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  PID:1876
                                • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                                  7⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1232
                                • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                  7⤵
                                  • Disables RegEdit via registry modification
                                  • Drops file in Program Files directory
                                  PID:896
                                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                                    8⤵
                                      PID:1264
                                    • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                                      8⤵
                                        PID:1612
                                      • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                                        8⤵
                                          PID:628
                                        • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                                          8⤵
                                            PID:2176
                                        • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                          "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                          7⤵
                                            PID:1904
                                          • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                            7⤵
                                              PID:824
                                            • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                              7⤵
                                                PID:1856
                                              • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                                "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                                7⤵
                                                  PID:2200
                                              • C:\Program Files\Common Files\Services\backup.exe
                                                "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:1264
                                              • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                                "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:1616
                                                • C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe
                                                  "C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:1568
                                              • C:\Program Files\Common Files\System\backup.exe
                                                "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                                6⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Drops file in Program Files directory
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:764
                                                • C:\Program Files\Common Files\System\ado\data.exe
                                                  "C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\
                                                  7⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  PID:1432
                                                  • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                    8⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    PID:1900
                                                  • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                    "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                    8⤵
                                                      PID:1060
                                                    • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                      "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                      8⤵
                                                        PID:1968
                                                      • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                                        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                        8⤵
                                                          PID:2052
                                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                          8⤵
                                                            PID:2168
                                                        • C:\Program Files\Common Files\System\de-DE\backup.exe
                                                          "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                                          7⤵
                                                            PID:964
                                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                                            7⤵
                                                              PID:1688
                                                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                                                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                                              7⤵
                                                                PID:1976
                                                              • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                                "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                                7⤵
                                                                  PID:2152
                                                            • C:\Program Files\DVD Maker\backup.exe
                                                              "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                              5⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Executes dropped EXE
                                                              • Drops file in Program Files directory
                                                              • Suspicious use of SetWindowsHookEx
                                                              • System policy modification
                                                              PID:968
                                                              • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                                "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:552
                                                              • C:\Program Files\DVD Maker\en-US\System Restore.exe
                                                                "C:\Program Files\DVD Maker\en-US\System Restore.exe" C:\Program Files\DVD Maker\en-US\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:572
                                                              • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:1356
                                                              • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Suspicious use of SetWindowsHookEx
                                                                PID:1612
                                                              • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                6⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • System policy modification
                                                                PID:1700
                                                              • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                6⤵
                                                                  PID:1684
                                                                • C:\Program Files\DVD Maker\Shared\backup.exe
                                                                  "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                                  6⤵
                                                                    PID:2044
                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                                      7⤵
                                                                        PID:1700
                                                                  • C:\Program Files\Google\backup.exe
                                                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                    5⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • System policy modification
                                                                    PID:1068
                                                                    • C:\Program Files\Google\Chrome\backup.exe
                                                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                      6⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:528
                                                                      • C:\Program Files\Google\Chrome\Application\data.exe
                                                                        "C:\Program Files\Google\Chrome\Application\data.exe" C:\Program Files\Google\Chrome\Application\
                                                                        7⤵
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1004
                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1888
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                            9⤵
                                                                            • System policy modification
                                                                            PID:1780
                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                            9⤵
                                                                              PID:540
                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                              9⤵
                                                                                PID:1412
                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                9⤵
                                                                                  PID:300
                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                  9⤵
                                                                                    PID:2108
                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\data.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                    9⤵
                                                                                      PID:2284
                                                                                  • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                                                    8⤵
                                                                                      PID:1748
                                                                                    • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                      8⤵
                                                                                        PID:1236
                                                                                • C:\Program Files\Internet Explorer\backup.exe
                                                                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                  5⤵
                                                                                    PID:1924
                                                                                  • C:\Program Files\Java\backup.exe
                                                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                    5⤵
                                                                                      PID:1720
                                                                                    • C:\Program Files\Microsoft Games\backup.exe
                                                                                      "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                      5⤵
                                                                                        PID:1896
                                                                                      • C:\Program Files\Microsoft Office\backup.exe
                                                                                        "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                        5⤵
                                                                                          PID:2184
                                                                                      • C:\Program Files (x86)\backup.exe
                                                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                        4⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Program Files directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:1312
                                                                                        • C:\Program Files (x86)\Adobe\backup.exe
                                                                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                          5⤵
                                                                                          • Executes dropped EXE
                                                                                          • Drops file in Program Files directory
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • System policy modification
                                                                                          PID:692
                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                            6⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Program Files directory
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1696
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                              7⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Executes dropped EXE
                                                                                              • System policy modification
                                                                                              PID:1324
                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                              7⤵
                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                              • Disables RegEdit via registry modification
                                                                                              • Drops file in Program Files directory
                                                                                              PID:1596
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                8⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • System policy modification
                                                                                                PID:1132
                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                8⤵
                                                                                                  PID:1676
                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                  8⤵
                                                                                                    PID:1880
                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe
                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                    8⤵
                                                                                                      PID:2060
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                      8⤵
                                                                                                        PID:2144
                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                      7⤵
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • System policy modification
                                                                                                      PID:568
                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                                        8⤵
                                                                                                          PID:1200
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                                          8⤵
                                                                                                            PID:2084
                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                          7⤵
                                                                                                            PID:188
                                                                                                      • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                        "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                        5⤵
                                                                                                          PID:688
                                                                                                        • C:\Program Files (x86)\Google\backup.exe
                                                                                                          "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                          5⤵
                                                                                                            PID:980
                                                                                                          • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                            "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                            5⤵
                                                                                                              PID:572
                                                                                                            • C:\Program Files (x86)\Microsoft Analysis Services\data.exe
                                                                                                              "C:\Program Files (x86)\Microsoft Analysis Services\data.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                              5⤵
                                                                                                                PID:2192
                                                                                                            • C:\Users\backup.exe
                                                                                                              C:\Users\backup.exe C:\Users\
                                                                                                              4⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              • Disables RegEdit via registry modification
                                                                                                              • Executes dropped EXE
                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                              • System policy modification
                                                                                                              PID:300
                                                                                                              • C:\Users\Admin\backup.exe
                                                                                                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                5⤵
                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                • Disables RegEdit via registry modification
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                PID:1648
                                                                                                                • C:\Users\Admin\Contacts\backup.exe
                                                                                                                  C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:1408
                                                                                                                • C:\Users\Admin\Desktop\backup.exe
                                                                                                                  C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  PID:800
                                                                                                                • C:\Users\Admin\Documents\backup.exe
                                                                                                                  C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                  • System policy modification
                                                                                                                  PID:1592
                                                                                                                • C:\Users\Admin\Downloads\backup.exe
                                                                                                                  C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                  6⤵
                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                  • System policy modification
                                                                                                                  PID:552
                                                                                                                • C:\Users\Admin\Favorites\backup.exe
                                                                                                                  C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                  6⤵
                                                                                                                    PID:1588
                                                                                                                  • C:\Users\Admin\Links\backup.exe
                                                                                                                    C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                    6⤵
                                                                                                                      PID:1172
                                                                                                                    • C:\Users\Admin\Music\backup.exe
                                                                                                                      C:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\
                                                                                                                      6⤵
                                                                                                                        PID:1964
                                                                                                                      • C:\Users\Admin\Pictures\update.exe
                                                                                                                        C:\Users\Admin\Pictures\update.exe C:\Users\Admin\Pictures\
                                                                                                                        6⤵
                                                                                                                          PID:1504
                                                                                                                        • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                          "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                          6⤵
                                                                                                                            PID:2160
                                                                                                                        • C:\Users\Public\backup.exe
                                                                                                                          C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                          5⤵
                                                                                                                            PID:828
                                                                                                                            • C:\Users\Public\Documents\backup.exe
                                                                                                                              C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                              6⤵
                                                                                                                                PID:1480
                                                                                                                              • C:\Users\Public\Downloads\data.exe
                                                                                                                                C:\Users\Public\Downloads\data.exe C:\Users\Public\Downloads\
                                                                                                                                6⤵
                                                                                                                                  PID:2092
                                                                                                                                • C:\Users\Public\Music\backup.exe
                                                                                                                                  C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                  6⤵
                                                                                                                                    PID:2276
                                                                                                                              • C:\Windows\backup.exe
                                                                                                                                C:\Windows\backup.exe C:\Windows\
                                                                                                                                4⤵
                                                                                                                                  PID:1564
                                                                                                                                  • C:\Windows\addins\backup.exe
                                                                                                                                    C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                    5⤵
                                                                                                                                      PID:552
                                                                                                                                    • C:\Windows\AppCompat\data.exe
                                                                                                                                      C:\Windows\AppCompat\data.exe C:\Windows\AppCompat\
                                                                                                                                      5⤵
                                                                                                                                        PID:2100
                                                                                                                                      • C:\Windows\AppPatch\backup.exe
                                                                                                                                        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                        5⤵
                                                                                                                                          PID:2268
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1060
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                    2⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1104
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • System policy modification
                                                                                                                                    PID:268
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • System policy modification
                                                                                                                                    PID:2044
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                    2⤵
                                                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:1444
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                    2⤵
                                                                                                                                    • Disables RegEdit via registry modification
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    • System policy modification
                                                                                                                                    PID:1612

                                                                                                                                Network

                                                                                                                                MITRE ATT&CK Enterprise v6

                                                                                                                                Replay Monitor

                                                                                                                                Loading Replay Monitor...

                                                                                                                                Downloads

                                                                                                                                • C:\PerfLogs\Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d015a4271e191dd69ffe7a64a65b7ab0

                                                                                                                                  SHA1

                                                                                                                                  2c0429f0a50ffc9cbc6b63a7af9f854fd4dfa664

                                                                                                                                  SHA256

                                                                                                                                  4f07597e84a32098c05d2954d51c8f6dd342f806e7d98040b8679e02dd5afeb2

                                                                                                                                  SHA512

                                                                                                                                  7b98c9fb20b07966d50c7bb292b3af1ca39ef84a7fe9c73599f384438f2d873fbf1d3efde23e17bed3e406d20bdffc51c31facdbe6910ea6641e98af22237fc1

                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • C:\PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • C:\Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • C:\Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • C:\Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3509248515\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\3509248515\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  9f0c9c0cb4fbc11cc7a8f6cec4c66846

                                                                                                                                  SHA1

                                                                                                                                  5b11465e3a692b4fdb60f7235785f062128164b5

                                                                                                                                  SHA256

                                                                                                                                  fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87

                                                                                                                                  SHA512

                                                                                                                                  35037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  9f0c9c0cb4fbc11cc7a8f6cec4c66846

                                                                                                                                  SHA1

                                                                                                                                  5b11465e3a692b4fdb60f7235785f062128164b5

                                                                                                                                  SHA256

                                                                                                                                  fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87

                                                                                                                                  SHA512

                                                                                                                                  35037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24

                                                                                                                                • C:\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  30325186962915ae26e4a5751b500c4e

                                                                                                                                  SHA1

                                                                                                                                  ab82304e3d4cdf21bc5eb739c26fd7c4972550dc

                                                                                                                                  SHA256

                                                                                                                                  f428a19e91f48ca8ae3dc879bc47f8860cbc4f91e8e60e89a7e26d0d08ea8209

                                                                                                                                  SHA512

                                                                                                                                  d115a94c6365bcc0b611933cb034d9f4550c01d020a023df282209de7e6f53c7a05b3d3fac232387a7e15c9295b20dc2fde064f6e90a9f35768feaac5b13bc82

                                                                                                                                • C:\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  30325186962915ae26e4a5751b500c4e

                                                                                                                                  SHA1

                                                                                                                                  ab82304e3d4cdf21bc5eb739c26fd7c4972550dc

                                                                                                                                  SHA256

                                                                                                                                  f428a19e91f48ca8ae3dc879bc47f8860cbc4f91e8e60e89a7e26d0d08ea8209

                                                                                                                                  SHA512

                                                                                                                                  d115a94c6365bcc0b611933cb034d9f4550c01d020a023df282209de7e6f53c7a05b3d3fac232387a7e15c9295b20dc2fde064f6e90a9f35768feaac5b13bc82

                                                                                                                                • \PerfLogs\Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d015a4271e191dd69ffe7a64a65b7ab0

                                                                                                                                  SHA1

                                                                                                                                  2c0429f0a50ffc9cbc6b63a7af9f854fd4dfa664

                                                                                                                                  SHA256

                                                                                                                                  4f07597e84a32098c05d2954d51c8f6dd342f806e7d98040b8679e02dd5afeb2

                                                                                                                                  SHA512

                                                                                                                                  7b98c9fb20b07966d50c7bb292b3af1ca39ef84a7fe9c73599f384438f2d873fbf1d3efde23e17bed3e406d20bdffc51c31facdbe6910ea6641e98af22237fc1

                                                                                                                                • \PerfLogs\Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  d015a4271e191dd69ffe7a64a65b7ab0

                                                                                                                                  SHA1

                                                                                                                                  2c0429f0a50ffc9cbc6b63a7af9f854fd4dfa664

                                                                                                                                  SHA256

                                                                                                                                  4f07597e84a32098c05d2954d51c8f6dd342f806e7d98040b8679e02dd5afeb2

                                                                                                                                  SHA512

                                                                                                                                  7b98c9fb20b07966d50c7bb292b3af1ca39ef84a7fe9c73599f384438f2d873fbf1d3efde23e17bed3e406d20bdffc51c31facdbe6910ea6641e98af22237fc1

                                                                                                                                • \PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • \PerfLogs\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • \Program Files\7-Zip\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  887540c682547c59ae0752868cc5fa37

                                                                                                                                  SHA1

                                                                                                                                  259a46b60d65ac5a0e17ec5fac2b748ab1578827

                                                                                                                                  SHA256

                                                                                                                                  644acec3675d8b9376f9d0efd3700f6d90129ff5937af4173cf3cecb9c99f762

                                                                                                                                  SHA512

                                                                                                                                  f451e1ecd8812f6529f1f4e734e7fd21655fd038cd1079f28db04e0b85ddde8ec03f1427c053b7b5d1d0d184b5b6391a293eb05c23edbfa8992210ecdfcde59a

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  36cfd7e25c5b7bba1ba0058447813ebb

                                                                                                                                  SHA1

                                                                                                                                  ad2bf8960efe9d006d59d37359f4437ae9171990

                                                                                                                                  SHA256

                                                                                                                                  befaa5e44f9e0e9e7a4597e51598e98474cecfb453f3a907fd8369d2df6f0fbf

                                                                                                                                  SHA512

                                                                                                                                  69de82b78e4ff55c85c288dff91f4aaec87c98c21bdacbba2f363f74f428dece477fda4a2bf916d812eeb5d6314547c8764d80169d13c3444761c01d9d249df1

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  75b3e35b7a2dd159dfdaf2ac19af21c2

                                                                                                                                  SHA1

                                                                                                                                  94aa1fbb19d4d46c768fd1b6fe466793cf9ebea9

                                                                                                                                  SHA256

                                                                                                                                  99043ee47aca68ed26694df15b2bda13a3e839dd6f0ea4a0cc4252f5e3584b34

                                                                                                                                  SHA512

                                                                                                                                  d57014c20b5c529ffc230551f25af6b071bb3982a28899ea3c14dc854f7866d3fb40ce2e1af69d42d2d6321066cefef3bb4c544f5894d956d6b3bb1d28d92462

                                                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • \Program Files\Common Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  a60c1b1c6f5bdcd2f20d506dd4de6a46

                                                                                                                                  SHA1

                                                                                                                                  c9c776c90a41fdc32a6264a1bcd70d2d4eda0b46

                                                                                                                                  SHA256

                                                                                                                                  65251e626e393cbbeef9ba68fa776600e56d8d3d28ad167e34a9e85a3862e862

                                                                                                                                  SHA512

                                                                                                                                  53618e268d64a5f2bfbffcc685cbed0758c8ae0448a56f09cb49710b6617e9aa7da4f22d45239521f18e71439c09d375b911aae2961e7419c71b1db92ea8cd49

                                                                                                                                • \Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • \Program Files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  8668839eb7ed7f5d623769c0563ba33d

                                                                                                                                  SHA1

                                                                                                                                  19a21586307a2e4b44673424bfddd32d43350413

                                                                                                                                  SHA256

                                                                                                                                  ce65eaa063531515a025d15b1bf42d08bedbd87e0f3518ba351614b522d73ee9

                                                                                                                                  SHA512

                                                                                                                                  157ae9d9af223a7c91deacb821c87cbb803fa987dbbfbbe8c119f368dd2882f908856119a73f6e9fbb034c38aa5df8719b50a33348b1ecfe5e704c03c7186303

                                                                                                                                • \Users\Admin\AppData\Local\Temp\3509248515\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\3509248515\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  9f0c9c0cb4fbc11cc7a8f6cec4c66846

                                                                                                                                  SHA1

                                                                                                                                  5b11465e3a692b4fdb60f7235785f062128164b5

                                                                                                                                  SHA256

                                                                                                                                  fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87

                                                                                                                                  SHA512

                                                                                                                                  35037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24

                                                                                                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  9f0c9c0cb4fbc11cc7a8f6cec4c66846

                                                                                                                                  SHA1

                                                                                                                                  5b11465e3a692b4fdb60f7235785f062128164b5

                                                                                                                                  SHA256

                                                                                                                                  fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87

                                                                                                                                  SHA512

                                                                                                                                  35037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24

                                                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  b966893952dc99b635b8b240beb77a3b

                                                                                                                                  SHA1

                                                                                                                                  1024cf59d6028f9349b3363bff78bd66dd5c6f88

                                                                                                                                  SHA256

                                                                                                                                  190894a731739036439bc67aa9fefdd908ded38ff95ad7255dafc55299263e24

                                                                                                                                  SHA512

                                                                                                                                  f5a7dca5e387f151b25dbe03068c1b8fce32515a7d9bb3262140bbc84a1792d8d92ea1d7d3eb21b319628e660bf7a0faa167b1f9ad2427cc6dc139634fd9f1a5

                                                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  9f0c9c0cb4fbc11cc7a8f6cec4c66846

                                                                                                                                  SHA1

                                                                                                                                  5b11465e3a692b4fdb60f7235785f062128164b5

                                                                                                                                  SHA256

                                                                                                                                  fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87

                                                                                                                                  SHA512

                                                                                                                                  35037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24

                                                                                                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                                                                  Filesize

                                                                                                                                  72KB

                                                                                                                                  MD5

                                                                                                                                  9f0c9c0cb4fbc11cc7a8f6cec4c66846

                                                                                                                                  SHA1

                                                                                                                                  5b11465e3a692b4fdb60f7235785f062128164b5

                                                                                                                                  SHA256

                                                                                                                                  fa53e383437f9fc669d3497cb0a3cfb47172c12ff215809c645e097b08240b87

                                                                                                                                  SHA512

                                                                                                                                  35037fa3d5117b48b79787871c7ab1d54812dad909be3c628ba0d867ba602511693448451f5339d4cd5c940fd2498db77595364bf3c904ad10c97fad3519bb24

                                                                                                                                • memory/1228-137-0x0000000074331000-0x0000000074333000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                • memory/1228-110-0x0000000075E81000-0x0000000075E83000-memory.dmp

                                                                                                                                  Filesize

                                                                                                                                  8KB

                                                                                                                                We care about your privacy.

                                                                                                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.