Analysis
-
max time kernel
94s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
23-11-2022 18:56
General
-
Target
ede9b57e9fbc455a3a6259df99e334c0c7c78ac734d4371374f308f218183bd4.exe
-
Size
72KB
-
MD5
509b09c1b95ef747e46785bccbe7f400
-
SHA1
2ecf58d6a96a1de874218dd2c9e09ad8fde5421b
-
SHA256
ede9b57e9fbc455a3a6259df99e334c0c7c78ac734d4371374f308f218183bd4
-
SHA512
fb943768543ac8f81ceeb8b85b663ab675d220dbddf2536de372341b6b5dcb795c6ca303e305d9eb1b84d0bbb2b21d2b537264cbe3ba0d24bbab5d3c88314104
-
SSDEEP
768:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrTd3FAyv/:HeT7BVwxfvqguKRFA6
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
-
Executes dropped EXE 64 IoCs
-
Loads dropped DLL 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 7 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of SetWindowsHookEx 64 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
System policy modification 1 TTPs 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ede9b57e9fbc455a3a6259df99e334c0c7c78ac734d4371374f308f218183bd4.exe"C:\Users\Admin\AppData\Local\Temp\ede9b57e9fbc455a3a6259df99e334c0c7c78ac734d4371374f308f218183bd4.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1501148593\backup.exeC:\Users\Admin\AppData\Local\Temp\1501148593\backup.exe C:\Users\Admin\AppData\Local\Temp\1501148593\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\data.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- System policy modification
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
-
C:\Program Files\Common Files\System\ado\en-US\System Restore.exe"C:\Program Files\Common Files\System\ado\en-US\System Restore.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\ado\ja-JP\update.exe"C:\Program Files\Common Files\System\ado\ja-JP\update.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\msadc\de-DE\backup.exe"C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\8⤵
-
C:\Program Files\Common Files\System\msadc\en-US\backup.exe"C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\msadc\es-ES\backup.exe"C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe"C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Common Files\System\msadc\it-IT\backup.exe"C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe"C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\8⤵
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵
- Drops file in Program Files directory
-
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵
-
C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe"C:\Program Files\Common Files\System\Ole DB\en-US\backup.exe" C:\Program Files\Common Files\System\Ole DB\en-US\8⤵
-
C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe"C:\Program Files\Common Files\System\Ole DB\es-ES\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\8⤵
- System policy modification
-
C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe"C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\8⤵
-
C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe"C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\8⤵
-
C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe"C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\8⤵
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- System policy modification
-
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- System policy modification
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- System policy modification
-
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
-
C:\Program Files\Google\Chrome\System Restore.exe"C:\Program Files\Google\Chrome\System Restore.exe" C:\Program Files\Google\Chrome\6⤵
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\9⤵
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\9⤵
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\update.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\update.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵
-
C:\Program Files (x86)\update.exe"C:\Program Files (x86)\update.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\8⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\9⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\10⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\11⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\8⤵
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\9⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\10⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\10⤵
- Drops file in Program Files directory
- System policy modification
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\11⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\11⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\11⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe"C:\Program Files (x86)\Common Files\Adobe\Help\System Restore.exe" C:\Program Files (x86)\Common Files\Adobe\Help\7⤵
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\8⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
-
C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\10⤵
-
C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\7⤵
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\7⤵
- System policy modification
-
C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\8⤵
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\6⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DAO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DAO\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\DW\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\DW\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\1033\8⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\EURO\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\EURO\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Filters\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Filters\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\Help\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\Help\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\ink\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\ink\7⤵
-
C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe"C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\MSClientDataMgr\7⤵
-
C:\Program Files (x86)\Common Files\Services\backup.exe"C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\6⤵
-
C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe"C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\6⤵
-
C:\Program Files (x86)\Common Files\System\backup.exe"C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\6⤵
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵
-
C:\Program Files (x86)\Microsoft Office\System Restore.exe"C:\Program Files (x86)\Microsoft Office\System Restore.exe" C:\Program Files (x86)\Microsoft Office\5⤵
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵
-
C:\Program Files (x86)\Microsoft Sync Framework\backup.exe"C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
-
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- System policy modification
-
C:\Users\Admin\Downloads\update.exeC:\Users\Admin\Downloads\update.exe C:\Users\Admin\Downloads\6⤵
- System policy modification
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵
-
C:\Users\Admin\Links\backup.exeC:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\Music\backup.exeC:\Users\Admin\Music\backup.exe C:\Users\Admin\Music\6⤵
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\Searches\backup.exeC:\Users\Admin\Searches\backup.exe C:\Users\Admin\Searches\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Admin\Videos\backup.exeC:\Users\Admin\Videos\backup.exe C:\Users\Admin\Videos\6⤵
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
-
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵
-
C:\Users\Public\Downloads\backup.exeC:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Public\Music\backup.exeC:\Users\Public\Music\backup.exe C:\Users\Public\Music\6⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Public\Music\Sample Music\backup.exe"C:\Users\Public\Music\Sample Music\backup.exe" C:\Users\Public\Music\Sample Music\7⤵
-
C:\Users\Public\Pictures\backup.exeC:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\6⤵
-
C:\Users\Public\Pictures\Sample Pictures\update.exe"C:\Users\Public\Pictures\Sample Pictures\update.exe" C:\Users\Public\Pictures\Sample Pictures\7⤵
-
C:\Users\Public\Recorded TV\backup.exe"C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\6⤵
- System policy modification
-
C:\Users\Public\Recorded TV\Sample Media\backup.exe"C:\Users\Public\Recorded TV\Sample Media\backup.exe" C:\Users\Public\Recorded TV\Sample Media\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Users\Public\Videos\backup.exeC:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\6⤵
- System policy modification
-
C:\Users\Public\Videos\Sample Videos\backup.exe"C:\Users\Public\Videos\Sample Videos\backup.exe" C:\Users\Public\Videos\Sample Videos\7⤵
- Modifies visibility of file extensions in Explorer
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Drops file in Windows directory
- System policy modification
-
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- System policy modification
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Windows directory
-
C:\Windows\AppPatch\AppPatch64\backup.exeC:\Windows\AppPatch\AppPatch64\backup.exe C:\Windows\AppPatch\AppPatch64\6⤵
-
C:\Windows\AppPatch\Custom\backup.exeC:\Windows\AppPatch\Custom\backup.exe C:\Windows\AppPatch\Custom\6⤵
- Drops file in Windows directory
-
C:\Windows\AppPatch\Custom\Custom64\backup.exeC:\Windows\AppPatch\Custom\Custom64\backup.exe C:\Windows\AppPatch\Custom\Custom64\7⤵
-
C:\Windows\AppPatch\de-DE\backup.exeC:\Windows\AppPatch\de-DE\backup.exe C:\Windows\AppPatch\de-DE\6⤵
-
C:\Windows\AppPatch\en-US\backup.exeC:\Windows\AppPatch\en-US\backup.exe C:\Windows\AppPatch\en-US\6⤵
-
C:\Windows\AppPatch\es-ES\backup.exeC:\Windows\AppPatch\es-ES\backup.exe C:\Windows\AppPatch\es-ES\6⤵
-
C:\Windows\AppPatch\fr-FR\backup.exeC:\Windows\AppPatch\fr-FR\backup.exe C:\Windows\AppPatch\fr-FR\6⤵
-
C:\Windows\AppPatch\it-IT\update.exeC:\Windows\AppPatch\it-IT\update.exe C:\Windows\AppPatch\it-IT\6⤵
-
C:\Windows\AppPatch\ja-JP\backup.exeC:\Windows\AppPatch\ja-JP\backup.exe C:\Windows\AppPatch\ja-JP\6⤵
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵
-
C:\Windows\Branding\backup.exeC:\Windows\Branding\backup.exe C:\Windows\Branding\5⤵
-
C:\Windows\CSC\backup.exeC:\Windows\CSC\backup.exe C:\Windows\CSC\5⤵
-
C:\Windows\Cursors\backup.exeC:\Windows\Cursors\backup.exe C:\Windows\Cursors\5⤵
-
C:\Windows\debug\backup.exeC:\Windows\debug\backup.exe C:\Windows\debug\5⤵
-
C:\Windows\de-DE\backup.exeC:\Windows\de-DE\backup.exe C:\Windows\de-DE\5⤵
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PerfLogs\Admin\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
C:\PerfLogs\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
C:\PerfLogs\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
C:\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
C:\Program Files\7-Zip\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD5c4c68479b97984e0367b9533a84ca469
SHA15b928839f60dd2ec7244ed3bca21cc4fa9a3c53f
SHA256da5f64b7c50af13f14ecf72ccca506708257e6ee65641e3f8fd6dfce90f07463
SHA5120097ae4a1ef4f71249f8df9654fb0f454df0545c02cd1f164083dd99f7c181507ca0e75bf7a94561752ae19996d25b4cdeb43f64c00809875bf7eca8dfb8e48f
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
C:\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD5761580d15ddc385ec7cd516bd57663a0
SHA1ead0d6b513bd7dd23335beceddc0cb789f845c3a
SHA25620debfa80fcc33fd7eba8919c11c9da42dc58942babc495fae61de265b435d3e
SHA5128cde3053d4dcdc843d71ee376aed40aa17f519b6f9ba38478eee2fd7977a94f89f544d59eb4beda02ccd7bf2a1b0247698a97ac4f22a4d08ba28536cd1e66973
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD5761580d15ddc385ec7cd516bd57663a0
SHA1ead0d6b513bd7dd23335beceddc0cb789f845c3a
SHA25620debfa80fcc33fd7eba8919c11c9da42dc58942babc495fae61de265b435d3e
SHA5128cde3053d4dcdc843d71ee376aed40aa17f519b6f9ba38478eee2fd7977a94f89f544d59eb4beda02ccd7bf2a1b0247698a97ac4f22a4d08ba28536cd1e66973
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
C:\Program Files\Common Files\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
C:\Program Files\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
C:\Program Files\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
C:\Users\Admin\AppData\Local\Temp\1501148593\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
C:\Users\Admin\AppData\Local\Temp\1501148593\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
C:\backup.exeFilesize
72KB
MD5f7e3f5e1c4907fb2471c1aedcf4f8f91
SHA19e7431ffb7a150e2100184ee3a02b4791703a485
SHA25665a07cf7d258c3be8b759b5c2af42b25ee8c962a483f0302c81192fb94d0f9d5
SHA51264aa5a4f656e02696dd0310a8bac4abf45555173483284666106b20c91ca674e6ece2aa9bcae9eb3fccacd29d0151c35aa73e9a4e69b8475a0fc5a7b6cf8e8a1
-
C:\backup.exeFilesize
72KB
MD5f7e3f5e1c4907fb2471c1aedcf4f8f91
SHA19e7431ffb7a150e2100184ee3a02b4791703a485
SHA25665a07cf7d258c3be8b759b5c2af42b25ee8c962a483f0302c81192fb94d0f9d5
SHA51264aa5a4f656e02696dd0310a8bac4abf45555173483284666106b20c91ca674e6ece2aa9bcae9eb3fccacd29d0151c35aa73e9a4e69b8475a0fc5a7b6cf8e8a1
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
\PerfLogs\Admin\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
\PerfLogs\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
\PerfLogs\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
\Program Files\7-Zip\Lang\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
\Program Files\7-Zip\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD5c4c68479b97984e0367b9533a84ca469
SHA15b928839f60dd2ec7244ed3bca21cc4fa9a3c53f
SHA256da5f64b7c50af13f14ecf72ccca506708257e6ee65641e3f8fd6dfce90f07463
SHA5120097ae4a1ef4f71249f8df9654fb0f454df0545c02cd1f164083dd99f7c181507ca0e75bf7a94561752ae19996d25b4cdeb43f64c00809875bf7eca8dfb8e48f
-
\Program Files\Common Files\Microsoft Shared\Filters\backup.exeFilesize
72KB
MD5c4c68479b97984e0367b9533a84ca469
SHA15b928839f60dd2ec7244ed3bca21cc4fa9a3c53f
SHA256da5f64b7c50af13f14ecf72ccca506708257e6ee65641e3f8fd6dfce90f07463
SHA5120097ae4a1ef4f71249f8df9654fb0f454df0545c02cd1f164083dd99f7c181507ca0e75bf7a94561752ae19996d25b4cdeb43f64c00809875bf7eca8dfb8e48f
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
\Program Files\Common Files\Microsoft Shared\backup.exeFilesize
72KB
MD5e2a35f520899eded32dbc8ba34335955
SHA19834d0c8c19452d83396cf04067c4b0ed5a0282a
SHA256f094633ef8e26625cb4df00fb17aad61844905b64ccaaf248859077735ff0b96
SHA51236bf501048d57762a3e5eccd55328293ff99f9bb31dd7c78a247e54aa352f1a81017c3693210ac3c4ee6c595666170133ae4d029b2d1b9223eb9fbfbd8e2599a
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD5761580d15ddc385ec7cd516bd57663a0
SHA1ead0d6b513bd7dd23335beceddc0cb789f845c3a
SHA25620debfa80fcc33fd7eba8919c11c9da42dc58942babc495fae61de265b435d3e
SHA5128cde3053d4dcdc843d71ee376aed40aa17f519b6f9ba38478eee2fd7977a94f89f544d59eb4beda02ccd7bf2a1b0247698a97ac4f22a4d08ba28536cd1e66973
-
\Program Files\Common Files\Microsoft Shared\ink\backup.exeFilesize
72KB
MD5761580d15ddc385ec7cd516bd57663a0
SHA1ead0d6b513bd7dd23335beceddc0cb789f845c3a
SHA25620debfa80fcc33fd7eba8919c11c9da42dc58942babc495fae61de265b435d3e
SHA5128cde3053d4dcdc843d71ee376aed40aa17f519b6f9ba38478eee2fd7977a94f89f544d59eb4beda02ccd7bf2a1b0247698a97ac4f22a4d08ba28536cd1e66973
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exeFilesize
72KB
MD54fef04d214a9902b914b632f9d25bcc1
SHA163be67222961060ae38541257bc873ee690b17fe
SHA256bf6a402fdd07252d46580ae6a4c6d65133f59fb1a317f76184102fb816910996
SHA512ec646946d94dccf1c6f3a65e8a0142f0df3ec333c92c3c23cc18de8de2e7075ed1dfddc3da5737507039ff72f138115e88db5246e572b13886b6703886553a33
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
\Program Files\Common Files\backup.exeFilesize
72KB
MD5c5e0daaa113b3b055cd10bff9e8b8156
SHA1ec42c2479bf6e334dab538201eb63743589259e0
SHA256daf5a92b5d9c0a75be3ce70369d301d4927a764440fbf9a2f59e588742992c40
SHA5128d761f95d1829c9d8570fb01e1c687d158ae14c1ff40557d951d766cadfeb918678236c68a9818899f336c13b6ea8676bed082b56e33f9ae109158fc9043d26f
-
\Program Files\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
\Program Files\backup.exeFilesize
72KB
MD518417a97931283294a21ab456b33a1e8
SHA1eaa2376ff14fff07758b33e6538577b025d94010
SHA2566bd4b9b74eb8ee65f02b9e2f961108c9748cb394405f4f64f6d6d1f2b6c01d8e
SHA512b337ccf150eb7e13fafb2935a459f8d4944f22d775e00a4f60e992a491a9a5bc7e663b8d448727dee7b7c5abafe55c64782dea1ea3959e58d20f61e10991bf70
-
\Users\Admin\AppData\Local\Temp\1501148593\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
\Users\Admin\AppData\Local\Temp\1501148593\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
\Users\Admin\AppData\Local\Temp\Low\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeFilesize
72KB
MD56c4ddb652a3069f5b507eac8bbacab6a
SHA160cb143669b9d875ffb6a37bf2504b5fc698eed4
SHA2565d334f7a0948168b6f4de05d3bc374501e67d5a3067b89310f1fc10ff253355a
SHA512cf4f16746605ff5b192626e0ce578083522e344c8a276c9bc7d0df427f672c00cede4afebf4f4510e16c78b2b8d4af588ac6ff8bb07e6d97e8694b03c39e6384
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeFilesize
72KB
MD54b3724edd837419e600b70d8e995dbc9
SHA10834efa061ab3fd83a405e63e29d20eece0b2b64
SHA2564c3660c46817ec9f167792ecae6fc972d93cd8ed8a5a409fe314f3b2e98d8848
SHA512f5d8b8decdb5380b5eae8d7b3790415495ee5a914b1f482395c216fd4db0781741b7a941353601f7dfb3e55c934e98f9c1dd8e6b766987b91d8534d1bf4f52c9
-
memory/332-231-0x0000000000000000-mapping.dmp
-
memory/556-141-0x0000000000000000-mapping.dmp
-
memory/592-243-0x0000000000000000-mapping.dmp
-
memory/624-100-0x0000000000000000-mapping.dmp
-
memory/796-298-0x0000000000000000-mapping.dmp
-
memory/800-148-0x0000000000000000-mapping.dmp
-
memory/832-168-0x0000000000000000-mapping.dmp
-
memory/856-222-0x0000000000000000-mapping.dmp
-
memory/860-307-0x0000000000000000-mapping.dmp
-
memory/928-246-0x0000000000000000-mapping.dmp
-
memory/940-58-0x0000000000000000-mapping.dmp
-
memory/956-253-0x0000000000000000-mapping.dmp
-
memory/972-128-0x0000000000000000-mapping.dmp
-
memory/1032-237-0x0000000000000000-mapping.dmp
-
memory/1044-292-0x0000000000000000-mapping.dmp
-
memory/1044-204-0x0000000000000000-mapping.dmp
-
memory/1140-225-0x0000000000000000-mapping.dmp
-
memory/1144-304-0x0000000000000000-mapping.dmp
-
memory/1184-256-0x0000000000000000-mapping.dmp
-
memory/1280-120-0x0000000000000000-mapping.dmp
-
memory/1320-313-0x0000000000000000-mapping.dmp
-
memory/1324-228-0x0000000000000000-mapping.dmp
-
memory/1348-94-0x0000000000000000-mapping.dmp
-
memory/1368-210-0x0000000000000000-mapping.dmp
-
memory/1480-114-0x0000000000000000-mapping.dmp
-
memory/1484-195-0x0000000000000000-mapping.dmp
-
memory/1484-283-0x0000000000000000-mapping.dmp
-
memory/1484-88-0x0000000000000000-mapping.dmp
-
memory/1488-219-0x0000000000000000-mapping.dmp
-
memory/1496-213-0x0000000000000000-mapping.dmp
-
memory/1512-280-0x0000000000000000-mapping.dmp
-
memory/1512-191-0x0000000000000000-mapping.dmp
-
memory/1556-161-0x0000000000000000-mapping.dmp
-
memory/1580-295-0x0000000000000000-mapping.dmp
-
memory/1584-240-0x0000000000000000-mapping.dmp
-
memory/1600-201-0x0000000000000000-mapping.dmp
-
memory/1600-289-0x0000000000000000-mapping.dmp
-
memory/1668-155-0x0000000000000000-mapping.dmp
-
memory/1668-249-0x0000000000000000-mapping.dmp
-
memory/1672-216-0x0000000000000000-mapping.dmp
-
memory/1716-188-0x0000000000000000-mapping.dmp
-
memory/1744-277-0x0000000000000000-mapping.dmp
-
memory/1760-76-0x0000000000000000-mapping.dmp
-
memory/1760-185-0x0000000000000000-mapping.dmp
-
memory/1852-207-0x0000000000000000-mapping.dmp
-
memory/1868-98-0x0000000075021000-0x0000000075023000-memory.dmpFilesize
8KB
-
memory/1868-124-0x00000000745F1000-0x00000000745F3000-memory.dmpFilesize
8KB
-
memory/1884-198-0x0000000000000000-mapping.dmp
-
memory/1884-286-0x0000000000000000-mapping.dmp
-
memory/1896-182-0x0000000000000000-mapping.dmp
-
memory/1904-268-0x0000000000000000-mapping.dmp
-
memory/1936-310-0x0000000000000000-mapping.dmp
-
memory/1944-274-0x0000000000000000-mapping.dmp
-
memory/1944-82-0x0000000000000000-mapping.dmp
-
memory/1952-234-0x0000000000000000-mapping.dmp
-
memory/1956-135-0x0000000000000000-mapping.dmp
-
memory/1964-107-0x0000000000000000-mapping.dmp
-
memory/1964-301-0x0000000000000000-mapping.dmp
-
memory/1976-271-0x0000000000000000-mapping.dmp
-
memory/1980-64-0x0000000000000000-mapping.dmp
-
memory/1988-265-0x0000000000000000-mapping.dmp
-
memory/1992-259-0x0000000000000000-mapping.dmp
-
memory/2016-70-0x0000000000000000-mapping.dmp
-
memory/2020-262-0x0000000000000000-mapping.dmp
-
memory/2028-179-0x0000000000000000-mapping.dmp
-
memory/2044-174-0x0000000000000000-mapping.dmp