Analysis
-
max time kernel
151s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
23-11-2022 18:52
General
-
Target
9ef301b72df5752c0ac420651940fe1c1c11fa1279d6fb5add33562e0b3531fd.exe
-
Size
72KB
-
MD5
01a4cf938041e738525d52b6c8af42cd
-
SHA1
ba61ba3c2465080f65aa63a1a675a46e5d369a14
-
SHA256
9ef301b72df5752c0ac420651940fe1c1c11fa1279d6fb5add33562e0b3531fd
-
SHA512
a5c8e492a9424feba1e359a841caeb4db37aeabfe8a3eee77ecf9259dbec7a171772f27d2ad31bebaa9440a28a15596609c749caf76978d48ed6659b9182bbbe
-
SSDEEP
768:rpQNwC3BEc4QEfu0Ei8XxNDINE3BEJwRrCtk:teThavEjDWguKCtk
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ef301b72df5752c0ac420651940fe1c1c11fa1279d6fb5add33562e0b3531fd.exe"C:\Users\Admin\AppData\Local\Temp\9ef301b72df5752c0ac420651940fe1c1c11fa1279d6fb5add33562e0b3531fd.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\324608615\backup.exeC:\Users\Admin\AppData\Local\Temp\324608615\backup.exe C:\Users\Admin\AppData\Local\Temp\324608615\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\data.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
-
C:\Program Files\Common Files\Services\System Restore.exe"C:\Program Files\Common Files\Services\System Restore.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
-
C:\Program Files\Common Files\System\en-US\data.exe"C:\Program Files\Common Files\System\en-US\data.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
-
C:\Program Files\DVD Maker\de-DE\System Restore.exe"C:\Program Files\DVD Maker\de-DE\System Restore.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- System policy modification
-
C:\Program Files\DVD Maker\it-IT\update.exe"C:\Program Files\DVD Maker\it-IT\update.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Drops file in Program Files directory
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
-
C:\Program Files\Microsoft Games\Chess\backup.exe"C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\6⤵
-
C:\Program Files\Microsoft Games\FreeCell\backup.exe"C:\Program Files\Microsoft Games\FreeCell\backup.exe" C:\Program Files\Microsoft Games\FreeCell\6⤵
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵
-
C:\Program Files (x86)\Internet Explorer\en-US\backup.exe"C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\6⤵
-
C:\Program Files (x86)\Microsoft Analysis Services\update.exe"C:\Program Files (x86)\Microsoft Analysis Services\update.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\update.exeC:\Users\Admin\update.exe C:\Users\Admin\5⤵
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\Admin\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
C:\PerfLogs\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
C:\PerfLogs\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
C:\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5a832d95c7076cc928ee6cd7afe113f3f
SHA1d328cf99ab5b86e0577e1b8e7760616a2aecd92c
SHA256fe85b08318cc716df157c6e815202019ce595766aaa89ea506ed98c50fd0ee09
SHA512f812c86313062d39d2c93f046753ddeb2e682f6cb6125b37520b9d418388ef3e3beb90a714b3289f5ee404779c463fed25693a7b072f78cce7bdadbe1524306c
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD54fd9ceb9c3ea6feb3ad044630b5aecbf
SHA199cb18eba9dcfa9ad203a1ef21aceddb4b6b528c
SHA2566841d88b9bba93803340f90249187c2d05851352a9bf02b787b690f732be695f
SHA512831a2dae58b975e37cfde528a999576544a63a3904809461d0096f4fb88fdbfbd59cbae99351ba5af6fa2eb65ddf4edc3f05148ffa2b26555cddf8804a37513d
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD54fd9ceb9c3ea6feb3ad044630b5aecbf
SHA199cb18eba9dcfa9ad203a1ef21aceddb4b6b528c
SHA2566841d88b9bba93803340f90249187c2d05851352a9bf02b787b690f732be695f
SHA512831a2dae58b975e37cfde528a999576544a63a3904809461d0096f4fb88fdbfbd59cbae99351ba5af6fa2eb65ddf4edc3f05148ffa2b26555cddf8804a37513d
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD5a6843933417af5826e8f410ec4004c49
SHA13757eba53c020cfb9a3d150c4fb425505215ea92
SHA2565dd45132c2bee7f8cea94e7c95a0dc0977a986b6f25c106c8a700b313631abaa
SHA512b6ed83744072a5ae5fecff68c11d7ee6ab12798ba47eca6874004945f08037efa5abd8881fab876b2f0a19f7581bf28ad8bfa48bbe39ad9401db3a897f2a28eb
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD5a6843933417af5826e8f410ec4004c49
SHA13757eba53c020cfb9a3d150c4fb425505215ea92
SHA2565dd45132c2bee7f8cea94e7c95a0dc0977a986b6f25c106c8a700b313631abaa
SHA512b6ed83744072a5ae5fecff68c11d7ee6ab12798ba47eca6874004945f08037efa5abd8881fab876b2f0a19f7581bf28ad8bfa48bbe39ad9401db3a897f2a28eb
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5ffbdb417651cc74f37882dfd91b452e9
SHA1d51ae5b4492ad2d503eb4edd6ba8d33b127b20ea
SHA25639e368cf843fdffe7953a92bdfa411bdf380c617133c80690b32701146880d7a
SHA512a1d6f396d3c198cf994f1eebbdf5564d4571b6e03935c5b147eb30ffaed1ac5036b4bce13ed946d7acf82fa6be61e4423e59df21aa8fde816a75d7ce5791b2eb
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5ffbdb417651cc74f37882dfd91b452e9
SHA1d51ae5b4492ad2d503eb4edd6ba8d33b127b20ea
SHA25639e368cf843fdffe7953a92bdfa411bdf380c617133c80690b32701146880d7a
SHA512a1d6f396d3c198cf994f1eebbdf5564d4571b6e03935c5b147eb30ffaed1ac5036b4bce13ed946d7acf82fa6be61e4423e59df21aa8fde816a75d7ce5791b2eb
-
C:\Program Files\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
C:\Program Files\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
C:\Users\Admin\AppData\Local\Temp\324608615\backup.exeFilesize
72KB
MD515a8ed1acb094bd5f6bfbee9a0de258a
SHA166c80bf8a0dd3a6a3f30afda550ad77f97a47117
SHA2566bc56c43a761b973f5b6827a58cf0fabf220d875122f10bb809a7f185ae87852
SHA512dc3b113c331d4c96833fef0412f40a713eccea9ec237d9ac2582d1299b1b3a53bb43fcb93bdb651e5d75cb5e152f23f3ffc7e7e53c5cbad2a2518035d136a284
-
C:\Users\Admin\AppData\Local\Temp\324608615\backup.exeFilesize
72KB
MD515a8ed1acb094bd5f6bfbee9a0de258a
SHA166c80bf8a0dd3a6a3f30afda550ad77f97a47117
SHA2566bc56c43a761b973f5b6827a58cf0fabf220d875122f10bb809a7f185ae87852
SHA512dc3b113c331d4c96833fef0412f40a713eccea9ec237d9ac2582d1299b1b3a53bb43fcb93bdb651e5d75cb5e152f23f3ffc7e7e53c5cbad2a2518035d136a284
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD51624cf110181ae800fb6a2c842b85f88
SHA1b215300d5907606992ff5b7d99e0759668195aab
SHA2565e83921787fce615e1218c7fccd5042216cf7d4a1acaafa7d06261ecba59ed16
SHA51220254efc7909989c6d1532e13d258df22b33c5bbdac6653035c7e245eca0d0be9955f7563bb9c26796b41db80cfd73371fb64a9cf0bae2f121e0d135ac3395fd
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
C:\backup.exeFilesize
72KB
MD59b4fca639caf170415b100cdf10cba9c
SHA1c00e8fc1053d1ded22decf3f302245f826067eae
SHA2561bbc7fdba8d7837e726d039dfec96b08f1dbec30387631ebe53b55dc009cd803
SHA5123107e1ee70e3a5911ade9dbedc4be77a2a6712796cffe352b83ff7f9f754a8e2597e7de5f60d8a82e0766aadfb472b3a3acddd3d64c0478d49b6421a02591963
-
C:\backup.exeFilesize
72KB
MD59b4fca639caf170415b100cdf10cba9c
SHA1c00e8fc1053d1ded22decf3f302245f826067eae
SHA2561bbc7fdba8d7837e726d039dfec96b08f1dbec30387631ebe53b55dc009cd803
SHA5123107e1ee70e3a5911ade9dbedc4be77a2a6712796cffe352b83ff7f9f754a8e2597e7de5f60d8a82e0766aadfb472b3a3acddd3d64c0478d49b6421a02591963
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
\PerfLogs\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
\PerfLogs\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5a832d95c7076cc928ee6cd7afe113f3f
SHA1d328cf99ab5b86e0577e1b8e7760616a2aecd92c
SHA256fe85b08318cc716df157c6e815202019ce595766aaa89ea506ed98c50fd0ee09
SHA512f812c86313062d39d2c93f046753ddeb2e682f6cb6125b37520b9d418388ef3e3beb90a714b3289f5ee404779c463fed25693a7b072f78cce7bdadbe1524306c
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5a832d95c7076cc928ee6cd7afe113f3f
SHA1d328cf99ab5b86e0577e1b8e7760616a2aecd92c
SHA256fe85b08318cc716df157c6e815202019ce595766aaa89ea506ed98c50fd0ee09
SHA512f812c86313062d39d2c93f046753ddeb2e682f6cb6125b37520b9d418388ef3e3beb90a714b3289f5ee404779c463fed25693a7b072f78cce7bdadbe1524306c
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD5705a3ac6c7f1ebe3e276077e25f5900f
SHA1d1d2fae075f21b4ff6768eb7bedabc2280754f9f
SHA2567023a93646750f61d5c73fa5ea6cf14b9889200274b8b0f9974591e52291c96e
SHA512a73ac3b91e2784b67805e4698a7af1322fd37fee778c1cd5ab3b4e3241a09ad98636b3787de10fcdd2c8fd9111e07c8ee16ca362649dc7eedabfbf89f9f6acc1
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD54fd9ceb9c3ea6feb3ad044630b5aecbf
SHA199cb18eba9dcfa9ad203a1ef21aceddb4b6b528c
SHA2566841d88b9bba93803340f90249187c2d05851352a9bf02b787b690f732be695f
SHA512831a2dae58b975e37cfde528a999576544a63a3904809461d0096f4fb88fdbfbd59cbae99351ba5af6fa2eb65ddf4edc3f05148ffa2b26555cddf8804a37513d
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD54fd9ceb9c3ea6feb3ad044630b5aecbf
SHA199cb18eba9dcfa9ad203a1ef21aceddb4b6b528c
SHA2566841d88b9bba93803340f90249187c2d05851352a9bf02b787b690f732be695f
SHA512831a2dae58b975e37cfde528a999576544a63a3904809461d0096f4fb88fdbfbd59cbae99351ba5af6fa2eb65ddf4edc3f05148ffa2b26555cddf8804a37513d
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD5a6843933417af5826e8f410ec4004c49
SHA13757eba53c020cfb9a3d150c4fb425505215ea92
SHA2565dd45132c2bee7f8cea94e7c95a0dc0977a986b6f25c106c8a700b313631abaa
SHA512b6ed83744072a5ae5fecff68c11d7ee6ab12798ba47eca6874004945f08037efa5abd8881fab876b2f0a19f7581bf28ad8bfa48bbe39ad9401db3a897f2a28eb
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD5a6843933417af5826e8f410ec4004c49
SHA13757eba53c020cfb9a3d150c4fb425505215ea92
SHA2565dd45132c2bee7f8cea94e7c95a0dc0977a986b6f25c106c8a700b313631abaa
SHA512b6ed83744072a5ae5fecff68c11d7ee6ab12798ba47eca6874004945f08037efa5abd8881fab876b2f0a19f7581bf28ad8bfa48bbe39ad9401db3a897f2a28eb
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD51b873897a453b3e93a3e4e49f2eb1d1e
SHA14a95bc01fbd58753ca06eda4b2a0baea162a6828
SHA25668b0d8a8c288c8543a29ce57e151e7b4a6b82d19bfedf513ff725a82c6fc460c
SHA5122738ab1d7d4eb51efc9d7979e448c4412603add68979d94e031e43a3a71ab5cdde12cc71d50c4d05acb5cb93e2aec76f2d386ce8c3a3b2198b8a243982e6beaa
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD5a6843933417af5826e8f410ec4004c49
SHA13757eba53c020cfb9a3d150c4fb425505215ea92
SHA2565dd45132c2bee7f8cea94e7c95a0dc0977a986b6f25c106c8a700b313631abaa
SHA512b6ed83744072a5ae5fecff68c11d7ee6ab12798ba47eca6874004945f08037efa5abd8881fab876b2f0a19f7581bf28ad8bfa48bbe39ad9401db3a897f2a28eb
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD5a6843933417af5826e8f410ec4004c49
SHA13757eba53c020cfb9a3d150c4fb425505215ea92
SHA2565dd45132c2bee7f8cea94e7c95a0dc0977a986b6f25c106c8a700b313631abaa
SHA512b6ed83744072a5ae5fecff68c11d7ee6ab12798ba47eca6874004945f08037efa5abd8881fab876b2f0a19f7581bf28ad8bfa48bbe39ad9401db3a897f2a28eb
-
\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exeFilesize
72KB
MD5bb7d701a1612c536f860fd82d0814310
SHA1d32f987fb35647f44094bb73d1cd74a8e201ff02
SHA256fef686b6cbc6ee96aeaa6d3dd996cf54a8536f36fc8dfc4eb133c84aa8b076a6
SHA51209e5a0a66174deba57acdaf6d91007d487ec92601b68dbc2a6f4718532595ea2916a43c2be018bc77ad4fd0c20eaa464165c3a23d9f687ed033aee61fbf35b39
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5ffbdb417651cc74f37882dfd91b452e9
SHA1d51ae5b4492ad2d503eb4edd6ba8d33b127b20ea
SHA25639e368cf843fdffe7953a92bdfa411bdf380c617133c80690b32701146880d7a
SHA512a1d6f396d3c198cf994f1eebbdf5564d4571b6e03935c5b147eb30ffaed1ac5036b4bce13ed946d7acf82fa6be61e4423e59df21aa8fde816a75d7ce5791b2eb
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5ffbdb417651cc74f37882dfd91b452e9
SHA1d51ae5b4492ad2d503eb4edd6ba8d33b127b20ea
SHA25639e368cf843fdffe7953a92bdfa411bdf380c617133c80690b32701146880d7a
SHA512a1d6f396d3c198cf994f1eebbdf5564d4571b6e03935c5b147eb30ffaed1ac5036b4bce13ed946d7acf82fa6be61e4423e59df21aa8fde816a75d7ce5791b2eb
-
\Program Files\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
\Program Files\backup.exeFilesize
72KB
MD5697eec1d25f04c717d9535042286be60
SHA1fe4df1749e70533f9ea8277aac0cf853f5f35b6e
SHA2565a34fbbd4d09baee2611554f689991ccfeb2291dcf9253c82048877dcd78946f
SHA512da503f0fa85023a03ef20757d5ea76c303463c394880a7530d8269869e5f402cd2afdd498d41bc75b8cabd47c3c001ecf542ab9fe1294d75ba6ac7bc7b61fd2e
-
\Users\Admin\AppData\Local\Temp\324608615\backup.exeFilesize
72KB
MD515a8ed1acb094bd5f6bfbee9a0de258a
SHA166c80bf8a0dd3a6a3f30afda550ad77f97a47117
SHA2566bc56c43a761b973f5b6827a58cf0fabf220d875122f10bb809a7f185ae87852
SHA512dc3b113c331d4c96833fef0412f40a713eccea9ec237d9ac2582d1299b1b3a53bb43fcb93bdb651e5d75cb5e152f23f3ffc7e7e53c5cbad2a2518035d136a284
-
\Users\Admin\AppData\Local\Temp\324608615\backup.exeFilesize
72KB
MD515a8ed1acb094bd5f6bfbee9a0de258a
SHA166c80bf8a0dd3a6a3f30afda550ad77f97a47117
SHA2566bc56c43a761b973f5b6827a58cf0fabf220d875122f10bb809a7f185ae87852
SHA512dc3b113c331d4c96833fef0412f40a713eccea9ec237d9ac2582d1299b1b3a53bb43fcb93bdb651e5d75cb5e152f23f3ffc7e7e53c5cbad2a2518035d136a284
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD51624cf110181ae800fb6a2c842b85f88
SHA1b215300d5907606992ff5b7d99e0759668195aab
SHA2565e83921787fce615e1218c7fccd5042216cf7d4a1acaafa7d06261ecba59ed16
SHA51220254efc7909989c6d1532e13d258df22b33c5bbdac6653035c7e245eca0d0be9955f7563bb9c26796b41db80cfd73371fb64a9cf0bae2f121e0d135ac3395fd
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD51624cf110181ae800fb6a2c842b85f88
SHA1b215300d5907606992ff5b7d99e0759668195aab
SHA2565e83921787fce615e1218c7fccd5042216cf7d4a1acaafa7d06261ecba59ed16
SHA51220254efc7909989c6d1532e13d258df22b33c5bbdac6653035c7e245eca0d0be9955f7563bb9c26796b41db80cfd73371fb64a9cf0bae2f121e0d135ac3395fd
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD5032c180ff43267a2edd6aeb1f11fe779
SHA135f5d5423eb02a448bb3197ee1a1851b9bac4da2
SHA256889c7136326595e8cefa8307775ae7919503140904d56a7558e727d3affcbe24
SHA512ee94625f0a24dee5120d23461aa3435adbafc1d1aeaf853f4dd3c560c61f33dd2e3df0a641d4e7e63463324d4282d8cfbc5a3075e6ac09f798f39e6193f862e6
-
memory/272-94-0x0000000000000000-mapping.dmp
-
memory/276-134-0x0000000000000000-mapping.dmp
-
memory/336-158-0x0000000074BC1000-0x0000000074BC3000-memory.dmpFilesize
8KB
-
memory/336-108-0x0000000076B51000-0x0000000076B53000-memory.dmpFilesize
8KB
-
memory/364-106-0x0000000000000000-mapping.dmp
-
memory/364-210-0x0000000000000000-mapping.dmp
-
memory/392-197-0x0000000000000000-mapping.dmp
-
memory/432-200-0x0000000000000000-mapping.dmp
-
memory/516-70-0x0000000000000000-mapping.dmp
-
memory/548-222-0x0000000000000000-mapping.dmp
-
memory/556-226-0x0000000000000000-mapping.dmp
-
memory/556-306-0x0000000000000000-mapping.dmp
-
memory/556-127-0x0000000000000000-mapping.dmp
-
memory/560-319-0x0000000000000000-mapping.dmp
-
memory/572-242-0x0000000000000000-mapping.dmp
-
memory/576-168-0x0000000000000000-mapping.dmp
-
memory/576-252-0x0000000000000000-mapping.dmp
-
memory/584-161-0x0000000000000000-mapping.dmp
-
memory/764-203-0x0000000000000000-mapping.dmp
-
memory/832-264-0x0000000000000000-mapping.dmp
-
memory/844-58-0x0000000000000000-mapping.dmp
-
memory/864-154-0x0000000000000000-mapping.dmp
-
memory/924-194-0x0000000000000000-mapping.dmp
-
memory/948-234-0x0000000000000000-mapping.dmp
-
memory/1012-88-0x0000000000000000-mapping.dmp
-
memory/1036-191-0x0000000000000000-mapping.dmp
-
memory/1044-214-0x0000000000000000-mapping.dmp
-
memory/1044-294-0x0000000000000000-mapping.dmp
-
memory/1152-206-0x0000000000000000-mapping.dmp
-
memory/1152-322-0x0000000000000000-mapping.dmp
-
memory/1164-76-0x0000000000000000-mapping.dmp
-
memory/1256-309-0x0000000000000000-mapping.dmp
-
memory/1268-246-0x0000000000000000-mapping.dmp
-
memory/1272-249-0x0000000000000000-mapping.dmp
-
memory/1272-64-0x0000000000000000-mapping.dmp
-
memory/1332-313-0x0000000000000000-mapping.dmp
-
memory/1384-147-0x0000000000000000-mapping.dmp
-
memory/1392-300-0x0000000000000000-mapping.dmp
-
memory/1400-297-0x0000000000000000-mapping.dmp
-
memory/1436-179-0x0000000000000000-mapping.dmp
-
memory/1452-99-0x0000000000000000-mapping.dmp
-
memory/1492-82-0x0000000000000000-mapping.dmp
-
memory/1508-182-0x0000000000000000-mapping.dmp
-
memory/1516-261-0x0000000000000000-mapping.dmp
-
memory/1532-279-0x0000000000000000-mapping.dmp
-
memory/1536-267-0x0000000000000000-mapping.dmp
-
memory/1556-270-0x0000000000000000-mapping.dmp
-
memory/1576-316-0x0000000000000000-mapping.dmp
-
memory/1588-188-0x0000000000000000-mapping.dmp
-
memory/1648-185-0x0000000000000000-mapping.dmp
-
memory/1656-238-0x0000000000000000-mapping.dmp
-
memory/1672-303-0x0000000000000000-mapping.dmp
-
memory/1688-174-0x0000000000000000-mapping.dmp
-
memory/1732-273-0x0000000000000000-mapping.dmp
-
memory/1772-258-0x0000000000000000-mapping.dmp
-
memory/1788-291-0x0000000000000000-mapping.dmp
-
memory/1808-285-0x0000000000000000-mapping.dmp
-
memory/1872-255-0x0000000000000000-mapping.dmp
-
memory/1880-276-0x0000000000000000-mapping.dmp
-
memory/1888-140-0x0000000000000000-mapping.dmp
-
memory/1944-120-0x0000000000000000-mapping.dmp
-
memory/1964-218-0x0000000000000000-mapping.dmp
-
memory/1976-114-0x0000000000000000-mapping.dmp
-
memory/1996-282-0x0000000000000000-mapping.dmp
-
memory/2008-288-0x0000000000000000-mapping.dmp
-
memory/2028-230-0x0000000000000000-mapping.dmp