Overview

overview

10

Static

static

3e1e1c3c6a...1c.exe

windows7-x64

10

3e1e1c3c6a...1c.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    151s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 18:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3e1e1c3c6a4f4319c77ad233b5b3c30b14e2c9017fb81a243c0966667fb1881c.exe

  • Size

    72KB

  • MD5

    0076e19e42b40e7d7c35a9c9fcc722e6

  • SHA1

    c86087d181edea3ce2152ab1ef1ae95be1e07ccb

  • SHA256

    3e1e1c3c6a4f4319c77ad233b5b3c30b14e2c9017fb81a243c0966667fb1881c

  • SHA512

    1cd8bcd4bb8f07d6b11882782bda5dc844bffa4dc1d280610a260f17df7f2457ed5029c86f39a0e70baffca96889bfb4d92a24f8400c1c01cd7f40d75b468d24

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2g:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrc

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\3e1e1c3c6a4f4319c77ad233b5b3c30b14e2c9017fb81a243c0966667fb1881c.exe
    "C:\Users\Admin\AppData\Local\Temp\3e1e1c3c6a4f4319c77ad233b5b3c30b14e2c9017fb81a243c0966667fb1881c.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Local\Temp\743970079\backup.exe
      C:\Users\Admin\AppData\Local\Temp\743970079\backup.exe C:\Users\Admin\AppData\Local\Temp\743970079\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1252
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:892
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1936
        • C:\Program Files\data.exe
          "C:\Program Files\data.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1516
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1372
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:328
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1860
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1316
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1928
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1732
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  PID:1484
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1684
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1708
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:572
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1384
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:656
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1956
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1588
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1748
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1496
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1008
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:428
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1700
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    PID:1492
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1624
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1212
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1944
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:964
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2016
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1768
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1396
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:888
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1760
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1924
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2024
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1088
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:852
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1468
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1600
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1604
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1932
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:812
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:300
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:848
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:2044
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:596
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1520
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1844
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1952
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1700
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1676
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:944
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1612
                • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1524
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1416
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:816
              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Drops file in Program Files directory
                PID:1908
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  PID:1056
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                  8⤵
                  • System policy modification
                  PID:1772
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                  8⤵
                  • System policy modification
                  PID:888
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                  8⤵
                    PID:1724
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                    8⤵
                      PID:820
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                      8⤵
                        PID:1636
                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                      7⤵
                        PID:2020
                        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                          8⤵
                          • System policy modification
                          PID:1088
                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        PID:468
                      • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                        7⤵
                          PID:1568
                        • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                          7⤵
                          • Modifies visibility of file extensions in Explorer
                          • Drops file in Program Files directory
                          PID:1840
                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                            8⤵
                              PID:1708
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:1604
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              PID:760
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                              8⤵
                                PID:1796
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                                8⤵
                                  PID:1536
                                • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                                  8⤵
                                  • System policy modification
                                  PID:1548
                              • C:\Program Files\Common Files\Microsoft Shared\Triedit\data.exe
                                "C:\Program Files\Common Files\Microsoft Shared\Triedit\data.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                7⤵
                                • Disables RegEdit via registry modification
                                • Drops file in Program Files directory
                                PID:1368
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\update.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:1748
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                                  8⤵
                                  • Modifies visibility of file extensions in Explorer
                                  PID:1496
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                                  8⤵
                                    PID:1520
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
                                    8⤵
                                    • Disables RegEdit via registry modification
                                    PID:1380
                                  • C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\update.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
                                    8⤵
                                      PID:1152
                                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
                                      8⤵
                                        PID:788
                                    • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                      7⤵
                                        PID:1752
                                      • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        PID:880
                                      • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                                        "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                                        7⤵
                                          PID:944
                                          • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
                                            "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
                                            8⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:1212
                                            • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
                                              "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
                                              9⤵
                                                PID:620
                                        • C:\Program Files\Common Files\Services\backup.exe
                                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                          6⤵
                                            PID:1608
                                          • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                            "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            PID:740
                                            • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                              "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                              7⤵
                                              • Disables RegEdit via registry modification
                                              • System policy modification
                                              PID:816
                                          • C:\Program Files\Common Files\System\backup.exe
                                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Program Files directory
                                            PID:1328
                                            • C:\Program Files\Common Files\System\ado\backup.exe
                                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                              7⤵
                                              • Drops file in Program Files directory
                                              PID:1396
                                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                                8⤵
                                                • Disables RegEdit via registry modification
                                                PID:1804
                                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                                8⤵
                                                • Disables RegEdit via registry modification
                                                PID:896
                                              • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                                "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:1980
                                              • C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe
                                                "C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                                8⤵
                                                • Disables RegEdit via registry modification
                                                PID:1632
                                              • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:920
                                              • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                                8⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:1464
                                            • C:\Program Files\Common Files\System\de-DE\System Restore.exe
                                              "C:\Program Files\Common Files\System\de-DE\System Restore.exe" C:\Program Files\Common Files\System\de-DE\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              PID:1768
                                            • C:\Program Files\Common Files\System\en-US\backup.exe
                                              "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                              7⤵
                                              • System policy modification
                                              PID:1824
                                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                              7⤵
                                              • Modifies visibility of file extensions in Explorer
                                              PID:1840
                                            • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                              "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                              7⤵
                                                PID:1916
                                              • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                PID:1616
                                              • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • System policy modification
                                                PID:1944
                                              • C:\Program Files\Common Files\System\msadc\backup.exe
                                                "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Drops file in Program Files directory
                                                PID:1732
                                                • C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
                                                  8⤵
                                                  • System policy modification
                                                  PID:1772
                                                • C:\Program Files\Common Files\System\msadc\en-US\backup.exe
                                                  "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
                                                  8⤵
                                                    PID:1468
                                                  • C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
                                                    "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
                                                    8⤵
                                                      PID:1956
                                                    • C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
                                                      "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
                                                      8⤵
                                                      • System policy modification
                                                      PID:1084
                                                    • C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
                                                      "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
                                                      8⤵
                                                        PID:1428
                                                      • C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
                                                        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
                                                        8⤵
                                                          PID:1804
                                                      • C:\Program Files\Common Files\System\Ole DB\backup.exe
                                                        "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
                                                        7⤵
                                                        • Drops file in Program Files directory
                                                        PID:1236
                                                        • C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
                                                          "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
                                                          8⤵
                                                            PID:1772
                                                          • C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe
                                                            "C:\Program Files\Common Files\System\Ole DB\en-US\System Restore.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
                                                            8⤵
                                                              PID:760
                                                            • C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
                                                              8⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • System policy modification
                                                              PID:848
                                                            • C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
                                                              "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
                                                              8⤵
                                                                PID:1948
                                                              • C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                PID:1980
                                                              • C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
                                                                "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
                                                                8⤵
                                                                  PID:1928
                                                          • C:\Program Files\DVD Maker\backup.exe
                                                            "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                            5⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Drops file in Program Files directory
                                                            PID:1276
                                                            • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                              "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                              6⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              • Disables RegEdit via registry modification
                                                              PID:1112
                                                            • C:\Program Files\DVD Maker\en-US\backup.exe
                                                              "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                              6⤵
                                                                PID:1588
                                                              • C:\Program Files\DVD Maker\es-ES\backup.exe
                                                                "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                                                6⤵
                                                                  PID:1764
                                                                • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                                  "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                                  6⤵
                                                                  • Disables RegEdit via registry modification
                                                                  PID:1628
                                                                • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                                  "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                                  6⤵
                                                                    PID:1756
                                                                  • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                                    "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                                    6⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    PID:820
                                                                  • C:\Program Files\DVD Maker\Shared\backup.exe
                                                                    "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                                    6⤵
                                                                    • System policy modification
                                                                    PID:1768
                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                                      7⤵
                                                                      • Drops file in Program Files directory
                                                                      • System policy modification
                                                                      PID:1840
                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                                        8⤵
                                                                          PID:620
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                                          8⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          PID:1092
                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                                          8⤵
                                                                            PID:1928
                                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
                                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
                                                                            8⤵
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1932
                                                                          • C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
                                                                            "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
                                                                            8⤵
                                                                              PID:1496
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              PID:1696
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
                                                                              8⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              PID:1212
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
                                                                              8⤵
                                                                              • Disables RegEdit via registry modification
                                                                              • System policy modification
                                                                              PID:620
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\data.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
                                                                              8⤵
                                                                              • Disables RegEdit via registry modification
                                                                              PID:1468
                                                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
                                                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
                                                                              8⤵
                                                                                PID:880
                                                                              • C:\Program Files\DVD Maker\Shared\DvdStyles\Push\data.exe
                                                                                "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
                                                                                8⤵
                                                                                  PID:1604
                                                                                • C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
                                                                                  "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
                                                                                  8⤵
                                                                                    PID:1692
                                                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
                                                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
                                                                                    8⤵
                                                                                      PID:2016
                                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
                                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
                                                                                      8⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      PID:1612
                                                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
                                                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
                                                                                      8⤵
                                                                                        PID:896
                                                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
                                                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
                                                                                        8⤵
                                                                                          PID:1536
                                                                                        • C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
                                                                                          "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
                                                                                          8⤵
                                                                                            PID:2096
                                                                                    • C:\Program Files\Google\backup.exe
                                                                                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                                                      5⤵
                                                                                      • Disables RegEdit via registry modification
                                                                                      • Drops file in Program Files directory
                                                                                      PID:520
                                                                                      • C:\Program Files\Google\Chrome\backup.exe
                                                                                        "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                                                        6⤵
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Drops file in Program Files directory
                                                                                        PID:1544
                                                                                        • C:\Program Files\Google\Chrome\Application\backup.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                                                          7⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Drops file in Program Files directory
                                                                                          PID:1380
                                                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                                                            8⤵
                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                            • Drops file in Program Files directory
                                                                                            • System policy modification
                                                                                            PID:1852
                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                                                              9⤵
                                                                                                PID:740
                                                                                              • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                                                                9⤵
                                                                                                  PID:1236
                                                                                                • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                                                                  9⤵
                                                                                                    PID:1476
                                                                                                  • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\
                                                                                                    9⤵
                                                                                                      PID:1596
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\
                                                                                                      9⤵
                                                                                                      • System policy modification
                                                                                                      PID:1368
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\
                                                                                                      9⤵
                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                      • Disables RegEdit via registry modification
                                                                                                      • System policy modification
                                                                                                      PID:1144
                                                                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\VisualElements\
                                                                                                      9⤵
                                                                                                        PID:1632
                                                                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\
                                                                                                        9⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • System policy modification
                                                                                                        PID:1592
                                                                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\
                                                                                                          10⤵
                                                                                                            PID:656
                                                                                                            • C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\WidevineCdm\_platform_specific\win_x64\
                                                                                                              11⤵
                                                                                                              • Modifies visibility of file extensions in Explorer
                                                                                                              PID:1764
                                                                                                      • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        • System policy modification
                                                                                                        PID:816
                                                                                                      • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                                                                        8⤵
                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                        PID:1016
                                                                                                • C:\Program Files\Internet Explorer\backup.exe
                                                                                                  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                                                                  5⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:1332
                                                                                                  • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                                                                    6⤵
                                                                                                    • System policy modification
                                                                                                    PID:1772
                                                                                                  • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                                                                    6⤵
                                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                                    PID:760
                                                                                                  • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                                                                    "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                                                                    6⤵
                                                                                                      PID:1608
                                                                                                    • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                                                                      "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                                                                      6⤵
                                                                                                        PID:1972
                                                                                                      • C:\Program Files\Internet Explorer\images\backup.exe
                                                                                                        "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                                                                        6⤵
                                                                                                          PID:1844
                                                                                                        • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                                                                          "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                                                                          6⤵
                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                          PID:1504
                                                                                                        • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                                                          "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                                                          6⤵
                                                                                                            PID:1744
                                                                                                          • C:\Program Files\Internet Explorer\SIGNUP\backup.exe
                                                                                                            "C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\
                                                                                                            6⤵
                                                                                                              PID:1752
                                                                                                          • C:\Program Files\Java\backup.exe
                                                                                                            "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                                                            5⤵
                                                                                                            • Disables RegEdit via registry modification
                                                                                                            PID:788
                                                                                                            • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                                                                              "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                                                                              6⤵
                                                                                                                PID:2064
                                                                                                            • C:\Program Files\Microsoft Games\backup.exe
                                                                                                              "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                                                              5⤵
                                                                                                              • System policy modification
                                                                                                              PID:1008
                                                                                                              • C:\Program Files\Microsoft Games\Chess\backup.exe
                                                                                                                "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
                                                                                                                6⤵
                                                                                                                  PID:2028
                                                                                                                • C:\Program Files\Microsoft Games\FreeCell\data.exe
                                                                                                                  "C:\Program Files\Microsoft Games\FreeCell\data.exe" C:\Program Files\Microsoft Games\FreeCell\
                                                                                                                  6⤵
                                                                                                                    PID:1532
                                                                                                                  • C:\Program Files\Microsoft Games\Hearts\backup.exe
                                                                                                                    "C:\Program Files\Microsoft Games\Hearts\backup.exe" C:\Program Files\Microsoft Games\Hearts\
                                                                                                                    6⤵
                                                                                                                      PID:2168
                                                                                                                  • C:\Program Files\Microsoft Office\backup.exe
                                                                                                                    "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                                                                    5⤵
                                                                                                                      PID:1860
                                                                                                                    • C:\Program Files\Mozilla Firefox\backup.exe
                                                                                                                      "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                                                                      5⤵
                                                                                                                        PID:1676
                                                                                                                      • C:\Program Files\MSBuild\backup.exe
                                                                                                                        "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                                                                        5⤵
                                                                                                                          PID:1596
                                                                                                                        • C:\Program Files\Reference Assemblies\backup.exe
                                                                                                                          "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                                                                          5⤵
                                                                                                                            PID:2120
                                                                                                                        • C:\Program Files (x86)\backup.exe
                                                                                                                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                                                                          4⤵
                                                                                                                          • Drops file in Program Files directory
                                                                                                                          • System policy modification
                                                                                                                          PID:860
                                                                                                                          • C:\Program Files (x86)\Adobe\backup.exe
                                                                                                                            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                                                                            5⤵
                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                            PID:1036
                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                                                                              6⤵
                                                                                                                              • Disables RegEdit via registry modification
                                                                                                                              • Drops file in Program Files directory
                                                                                                                              • System policy modification
                                                                                                                              PID:268
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                                                                                7⤵
                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                • System policy modification
                                                                                                                                PID:1496
                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                                                                                7⤵
                                                                                                                                • Drops file in Program Files directory
                                                                                                                                PID:280
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                                                                                  8⤵
                                                                                                                                  • System policy modification
                                                                                                                                  PID:620
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                                                                                  8⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  PID:888
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                                                                                  8⤵
                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                  PID:2020
                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                                                                  8⤵
                                                                                                                                    PID:1384
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                                                                                      9⤵
                                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                                      PID:848
                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                                                                    8⤵
                                                                                                                                      PID:1752
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                                                                                      8⤵
                                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                                      PID:1524
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
                                                                                                                                        9⤵
                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                        PID:1976
                                                                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                                                                                      8⤵
                                                                                                                                        PID:428
                                                                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\System Restore.exe
                                                                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
                                                                                                                                        8⤵
                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                        PID:1756
                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
                                                                                                                                          9⤵
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          PID:1396
                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
                                                                                                                                            10⤵
                                                                                                                                            • System policy modification
                                                                                                                                            PID:1100
                                                                                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
                                                                                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
                                                                                                                                          9⤵
                                                                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                                                                          • Disables RegEdit via registry modification
                                                                                                                                          PID:1844
                                                                                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
                                                                                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
                                                                                                                                            10⤵
                                                                                                                                              PID:2016
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
                                                                                                                                                11⤵
                                                                                                                                                  PID:1232
                                                                                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe
                                                                                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
                                                                                                                                              9⤵
                                                                                                                                              • System policy modification
                                                                                                                                              PID:1748
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
                                                                                                                                                10⤵
                                                                                                                                                  PID:1940
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
                                                                                                                                                9⤵
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                PID:964
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
                                                                                                                                                  10⤵
                                                                                                                                                    PID:1428
                                                                                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
                                                                                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
                                                                                                                                                8⤵
                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                • System policy modification
                                                                                                                                                PID:2020
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
                                                                                                                                                  9⤵
                                                                                                                                                    PID:1428
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
                                                                                                                                                  8⤵
                                                                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                                                                  PID:1568
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\data.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
                                                                                                                                                  8⤵
                                                                                                                                                    PID:1696
                                                                                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                                                                                  7⤵
                                                                                                                                                    PID:1948
                                                                                                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                                                                                    7⤵
                                                                                                                                                      PID:1936
                                                                                                                                                • C:\Program Files (x86)\Common Files\backup.exe
                                                                                                                                                  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                                                                                  5⤵
                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                  • System policy modification
                                                                                                                                                  PID:1624
                                                                                                                                                  • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                                                                                    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                                                                                    6⤵
                                                                                                                                                    • System policy modification
                                                                                                                                                    PID:1976
                                                                                                                                                    • C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe
                                                                                                                                                      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\update.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                                                                                                                      7⤵
                                                                                                                                                        PID:820
                                                                                                                                                      • C:\Program Files (x86)\Common Files\Adobe\Help\update.exe
                                                                                                                                                        "C:\Program Files (x86)\Common Files\Adobe\Help\update.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                                                                                                                        7⤵
                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                        PID:1476
                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
                                                                                                                                                          8⤵
                                                                                                                                                          • System policy modification
                                                                                                                                                          PID:1588
                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
                                                                                                                                                            9⤵
                                                                                                                                                              PID:896
                                                                                                                                                              • C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
                                                                                                                                                                10⤵
                                                                                                                                                                  PID:328
                                                                                                                                                          • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                                                                                                                            7⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            • Disables RegEdit via registry modification
                                                                                                                                                            • System policy modification
                                                                                                                                                            PID:1908
                                                                                                                                                        • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                                                                                                                          "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                                                                                          6⤵
                                                                                                                                                            PID:1980
                                                                                                                                                          • C:\Program Files (x86)\Common Files\DESIGNER\data.exe
                                                                                                                                                            "C:\Program Files (x86)\Common Files\DESIGNER\data.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                                                                                            6⤵
                                                                                                                                                            • Modifies visibility of file extensions in Explorer
                                                                                                                                                            PID:1100
                                                                                                                                                          • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                                                                                            "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                                                                                            6⤵
                                                                                                                                                              PID:1640
                                                                                                                                                            • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                                                                              "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                                                                              6⤵
                                                                                                                                                                PID:2040
                                                                                                                                                              • C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:2080
                                                                                                                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                                                                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:1760
                                                                                                                                                                • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                                                                                  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                                                                                  5⤵
                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                  • System policy modification
                                                                                                                                                                  PID:544
                                                                                                                                                                  • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                                                                                                    "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:1756
                                                                                                                                                                    • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                                                                                                      "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:1852
                                                                                                                                                                      • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:2088
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:1476
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:1376
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:1692
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:2160
                                                                                                                                                                            • C:\Users\backup.exe
                                                                                                                                                                              C:\Users\backup.exe C:\Users\
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:812
                                                                                                                                                                                • C:\Users\Admin\backup.exe
                                                                                                                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                                                                                                                  5⤵
                                                                                                                                                                                    PID:596
                                                                                                                                                                                    • C:\Users\Admin\Contacts\backup.exe
                                                                                                                                                                                      C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                                                                                                                      6⤵
                                                                                                                                                                                        PID:1368
                                                                                                                                                                                      • C:\Users\Admin\Desktop\backup.exe
                                                                                                                                                                                        C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:964
                                                                                                                                                                                      • C:\Users\Admin\Documents\backup.exe
                                                                                                                                                                                        C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                        • Disables RegEdit via registry modification
                                                                                                                                                                                        • System policy modification
                                                                                                                                                                                        PID:1724
                                                                                                                                                                                      • C:\Users\Admin\Downloads\backup.exe
                                                                                                                                                                                        C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                                                                                                                        6⤵
                                                                                                                                                                                          PID:468
                                                                                                                                                                                        • C:\Users\Admin\Favorites\backup.exe
                                                                                                                                                                                          C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                                                                                                                          6⤵
                                                                                                                                                                                            PID:1952
                                                                                                                                                                                          • C:\Users\Admin\Links\backup.exe
                                                                                                                                                                                            C:\Users\Admin\Links\backup.exe C:\Users\Admin\Links\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                            • System policy modification
                                                                                                                                                                                            PID:1244
                                                                                                                                                                                          • C:\Users\Admin\Music\System Restore.exe
                                                                                                                                                                                            "C:\Users\Admin\Music\System Restore.exe" C:\Users\Admin\Music\
                                                                                                                                                                                            6⤵
                                                                                                                                                                                              PID:1016
                                                                                                                                                                                            • C:\Users\Admin\Pictures\backup.exe
                                                                                                                                                                                              C:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\
                                                                                                                                                                                              6⤵
                                                                                                                                                                                                PID:1496
                                                                                                                                                                                              • C:\Users\Admin\Saved Games\backup.exe
                                                                                                                                                                                                "C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\
                                                                                                                                                                                                6⤵
                                                                                                                                                                                                  PID:936
                                                                                                                                                                                                • C:\Users\Admin\Searches\data.exe
                                                                                                                                                                                                  C:\Users\Admin\Searches\data.exe C:\Users\Admin\Searches\
                                                                                                                                                                                                  6⤵
                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                • C:\Users\Public\backup.exe
                                                                                                                                                                                                  C:\Users\Public\backup.exe C:\Users\Public\
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                  • Disables RegEdit via registry modification
                                                                                                                                                                                                  • System policy modification
                                                                                                                                                                                                  PID:1092
                                                                                                                                                                                                  • C:\Users\Public\Documents\backup.exe
                                                                                                                                                                                                    C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                    • System policy modification
                                                                                                                                                                                                    PID:552
                                                                                                                                                                                                  • C:\Users\Public\Downloads\backup.exe
                                                                                                                                                                                                    C:\Users\Public\Downloads\backup.exe C:\Users\Public\Downloads\
                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                      PID:1616
                                                                                                                                                                                                    • C:\Users\Public\Music\backup.exe
                                                                                                                                                                                                      C:\Users\Public\Music\backup.exe C:\Users\Public\Music\
                                                                                                                                                                                                      6⤵
                                                                                                                                                                                                        PID:1912
                                                                                                                                                                                                      • C:\Users\Public\Pictures\backup.exe
                                                                                                                                                                                                        C:\Users\Public\Pictures\backup.exe C:\Users\Public\Pictures\
                                                                                                                                                                                                        6⤵
                                                                                                                                                                                                          PID:1932
                                                                                                                                                                                                        • C:\Users\Public\Recorded TV\backup.exe
                                                                                                                                                                                                          "C:\Users\Public\Recorded TV\backup.exe" C:\Users\Public\Recorded TV\
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:1416
                                                                                                                                                                                                          • C:\Users\Public\Videos\backup.exe
                                                                                                                                                                                                            C:\Users\Public\Videos\backup.exe C:\Users\Public\Videos\
                                                                                                                                                                                                            6⤵
                                                                                                                                                                                                              PID:2112
                                                                                                                                                                                                        • C:\Windows\backup.exe
                                                                                                                                                                                                          C:\Windows\backup.exe C:\Windows\
                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                          • System policy modification
                                                                                                                                                                                                          PID:1144
                                                                                                                                                                                                          • C:\Windows\addins\backup.exe
                                                                                                                                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                                                                                                            5⤵
                                                                                                                                                                                                              PID:1804
                                                                                                                                                                                                            • C:\Windows\AppCompat\backup.exe
                                                                                                                                                                                                              C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                                                                                                              5⤵
                                                                                                                                                                                                                PID:960
                                                                                                                                                                                                              • C:\Windows\AppPatch\backup.exe
                                                                                                                                                                                                                C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                                                                                                                                5⤵
                                                                                                                                                                                                                  PID:816
                                                                                                                                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                                                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                    PID:1480
                                                                                                                                                                                                                  • C:\Windows\Branding\backup.exe
                                                                                                                                                                                                                    C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                                                                                                                                    5⤵
                                                                                                                                                                                                                      PID:2072
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:2020
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:560
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:268
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                • System policy modification
                                                                                                                                                                                                                PID:848
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Disables RegEdit via registry modification
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                PID:1368

                                                                                                                                                                                                            Network

                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                            • C:\PerfLogs\Admin\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              8c0efc4590acf37747594b1396a3b136

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              5d692ca8f3be40f0882d985bc50f2a4e0a262e31

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              fd7206c444013231d1bfc915fa922258a1097ab5bcffd1910d373b23b7e40bfa

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              0aae18e13a2780f411aff5c43a23c87d0a9ea35350f63b3820cd8355c9c7115a99c8a9183a02fe13e3d5bd6a8aea25876f972fb53459099c274fbaeb9f723fc9

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\PerfLogs\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\7-Zip\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\Common Files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\data.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Program Files\data.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\743970079\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\743970079\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              3b68f12f0faec99cffb613e69bef98a0

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              9877ff691e4258d1a2945ba526ae8e45fa64648e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              f6d7765174d6a6346e911338485685d20e82691f52f36b8170b0dce95d16b308

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              b63ea478ac7c8377d3b4a7e15251e6a200187a1c41ae858f369b861d592575ef9076935e67888537269924fde8e595907f88c2857a400b105150336abdcc6d95

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              e09e6b0d07551a553558317314345d4f

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              3726f4253c8cddffe6943d32c38dd36f7a3bd550

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5c2457cf61bb65599cfc183848148788a3325f7deadcf1b60a99d457262cdd7b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              77ade04291c529fed96c31c1e6086b89c70b813661c6150a2c4a5a7bf555808f2fdf935f760eadfe506f0f4e6969b9b076fbe15f2c4fd46e67ad567182c2d32b

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • C:\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              e09e6b0d07551a553558317314345d4f

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              3726f4253c8cddffe6943d32c38dd36f7a3bd550

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              5c2457cf61bb65599cfc183848148788a3325f7deadcf1b60a99d457262cdd7b

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              77ade04291c529fed96c31c1e6086b89c70b813661c6150a2c4a5a7bf555808f2fdf935f760eadfe506f0f4e6969b9b076fbe15f2c4fd46e67ad567182c2d32b

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              8c0efc4590acf37747594b1396a3b136

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              5d692ca8f3be40f0882d985bc50f2a4e0a262e31

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              fd7206c444013231d1bfc915fa922258a1097ab5bcffd1910d373b23b7e40bfa

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              0aae18e13a2780f411aff5c43a23c87d0a9ea35350f63b3820cd8355c9c7115a99c8a9183a02fe13e3d5bd6a8aea25876f972fb53459099c274fbaeb9f723fc9

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \PerfLogs\Admin\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              8c0efc4590acf37747594b1396a3b136

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              5d692ca8f3be40f0882d985bc50f2a4e0a262e31

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              fd7206c444013231d1bfc915fa922258a1097ab5bcffd1910d373b23b7e40bfa

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              0aae18e13a2780f411aff5c43a23c87d0a9ea35350f63b3820cd8355c9c7115a99c8a9183a02fe13e3d5bd6a8aea25876f972fb53459099c274fbaeb9f723fc9

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \PerfLogs\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\7-Zip\Lang\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\7-Zip\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              2b0cf3c137ed22c6991ff4a09b2e7f7e

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              fd43b98a4ded8afc09cf0c3df4acb046806fa6ca

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              7a7198a0af3acf825cba98acd362fde38b44f605ed079237dd7c117540a9a9e5

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              900d45519072fea1d7de641c6fd201b2a67b3230612478fd204d7a9871c1bff12d9c49ec2100dd2b7ecec4658afbe6123a8f8ae5d150185e6024de6ae5edf3fb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              7a1c0094ae1430a91aa04bb8ef88d210

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              570a0a28e7208a3d7b5775d5dacb07b014ab6c3b

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              b089016c4e67003a5ac3c8d56e8ff52a9f685fa824e0e64f3ff86a32c2afa116

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              915b12fb1f4fc89cedcc5320d4eb6e347c091cfe27accca80e9ef65505802e937d5bd23b5601d242c4b096372554c46b2faaf3f31d023f316c2413709674b3cb

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              86d72dea03dfc46f1c2858e87561c0f5

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              dd670c1fb0a90ebac706450ea346c6269058f563

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              4a7b556f21132a5f3aa9e1b189cea046fdcc1e535e76e8f98c88beaaa3177f0d

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              cbcd08a0f6adba6bba581cadf7ce69dd08107f83f5fa6c8a143c1e2faa16d35dd45802f29fa9e4c76ec38b45fa90d20c8bc2fb277c7b57f1fdd8d355aa5c8c87

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\Common Files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              0fa3515977a1c7a552bf7a964f619b90

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              6f5af7cf11a99c6c5178936dd2f650d6ca0370bb

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              9a3c5ac429a2211fe61017bf2e202132d8ca821fac6a790cb75cbdd5192f5ead

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              9aea10a6cb43400b7d9ebae1d522c76cb928e3e1b57c420aae70abff21f2e6acf746ebcb4754f1be836e23b19e4d99061103f884a9ad9eacb4435696ba62a817

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\data.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Program Files\data.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              ae0d97c30ad7b053596d1486cd5b5457

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              94c41efdc19db56b52a6df5afdff485ba7ac0a99

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              48b565a60fcc3c7ee7640a3e993c44f5e9428d383d8a34d546e5c8f2de1a99dd

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              e141de6e1894b639b83b00761361c3b30ab6738f73fcc877b7bc9c00a128e9db7bca39984ccb982998959a75714d344334f39eb6453e6e7bd09814c72e912bda

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\743970079\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\743970079\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              3b68f12f0faec99cffb613e69bef98a0

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              9877ff691e4258d1a2945ba526ae8e45fa64648e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              f6d7765174d6a6346e911338485685d20e82691f52f36b8170b0dce95d16b308

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              b63ea478ac7c8377d3b4a7e15251e6a200187a1c41ae858f369b861d592575ef9076935e67888537269924fde8e595907f88c2857a400b105150336abdcc6d95

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              3b68f12f0faec99cffb613e69bef98a0

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              9877ff691e4258d1a2945ba526ae8e45fa64648e

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              f6d7765174d6a6346e911338485685d20e82691f52f36b8170b0dce95d16b308

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              b63ea478ac7c8377d3b4a7e15251e6a200187a1c41ae858f369b861d592575ef9076935e67888537269924fde8e595907f88c2857a400b105150336abdcc6d95

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              72KB

                                                                                                                                                                                                              MD5

                                                                                                                                                                                                              76dca89ab641a6c53f2407300d255e29

                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                              569537c2d44f9c781a656a2c4223cced258ff3c7

                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                              6dc1ffa983adc40576a4e134d86cbb3bdea732629598288af035a99dd5fae709

                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                              67c92cac3e74dd4d6ef70c68bdfdcbd55be47b43ce9ad2ba0a53946b2ba44d7cdeae410e33f4b0869b6198e412cbb9e91a9f4878655443181dea65756d301d29

                                                                                                                                                                                                              Download Submit

                                                                                                                                                                                                            • memory/268-82-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/300-271-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/328-135-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/428-207-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/560-70-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/572-183-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/596-280-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/656-189-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/812-268-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/816-310-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/848-274-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/848-88-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/852-253-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/888-238-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/892-100-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/944-298-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/964-226-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1008-204-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1036-76-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1088-250-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1212-220-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1252-58-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1316-148-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1368-94-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1372-128-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1384-186-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1396-235-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1416-307-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1468-256-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1484-167-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1492-213-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1496-201-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1516-121-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1520-283-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1524-304-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1588-195-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1600-259-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1604-262-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1612-301-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1624-217-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1624-107-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1676-295-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1684-177-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1700-292-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1700-210-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1708-180-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1732-161-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1748-198-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1760-241-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1768-232-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1808-118-0x0000000074141000-0x0000000074143000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1808-98-0x0000000075991000-0x0000000075993000-memory.dmp

                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                              8KB

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1844-286-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1860-141-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1908-313-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1924-244-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1928-155-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1932-265-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1936-114-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1944-223-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1952-289-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/1956-192-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/2016-229-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/2020-64-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/2024-247-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download

                                                                                                                                                                                                            • memory/2044-277-0x0000000000000000-mapping.dmp

                                                                                                                                                                                                              Download