Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 13:46

General

  • Target

    cdf47edfe893e1bce6dd61d6344ae327e3f8e8ec3c4a87879620379984a86fc6.exe

  • Size

    72KB

  • MD5

    0299c70de3a5a8caffea62e9931fc07d

  • SHA1

    0aa8710e28c5a3d86b6a4c03a5ef628cafbd28f1

  • SHA256

    cdf47edfe893e1bce6dd61d6344ae327e3f8e8ec3c4a87879620379984a86fc6

  • SHA512

    65263c0ffd3b699d7fe97850e3fe4a29b222c029034112d671d9067df70f3b693585001727821b915189a7e135f7277f6cd0e16cde3938fb649b25de28ce393f

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2G:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPy

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 32 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 40 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 33 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cdf47edfe893e1bce6dd61d6344ae327e3f8e8ec3c4a87879620379984a86fc6.exe
    "C:\Users\Admin\AppData\Local\Temp\cdf47edfe893e1bce6dd61d6344ae327e3f8e8ec3c4a87879620379984a86fc6.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1348
    • C:\Users\Admin\AppData\Local\Temp\352603670\backup.exe
      C:\Users\Admin\AppData\Local\Temp\352603670\backup.exe C:\Users\Admin\AppData\Local\Temp\352603670\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1104
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1020
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1540
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:296
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2000
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1640
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:572
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2004
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1668
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1304
              • C:\Program Files\Common Files\Microsoft Shared\ink\data.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:1032
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1928
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1076
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                    PID:1780
                  • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                    8⤵
                      PID:852
                    • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                      8⤵
                        PID:1508
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:696
                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1980
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                        8⤵
                          PID:1968
                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                        • Executes dropped EXE
                        PID:2044
                      • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                        7⤵
                          PID:2024
                        • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                          7⤵
                            PID:876
                          • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                            7⤵
                              PID:1076
                            • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                              7⤵
                                PID:812
                            • C:\Program Files\Common Files\Services\backup.exe
                              "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:936
                            • C:\Program Files\Common Files\SpeechEngines\backup.exe
                              "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:812
                              • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                7⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1084
                            • C:\Program Files\Common Files\System\backup.exe
                              "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                              6⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1228
                              • C:\Program Files\Common Files\System\ado\backup.exe
                                "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                7⤵
                                • Executes dropped EXE
                                PID:1708
                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                7⤵
                                  PID:1800
                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                  7⤵
                                    PID:1088
                                  • C:\Program Files\Common Files\System\es-ES\backup.exe
                                    "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                    7⤵
                                      PID:1260
                                    • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                      7⤵
                                        PID:824
                                  • C:\Program Files\DVD Maker\backup.exe
                                    "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • System policy modification
                                    PID:996
                                    • C:\Program Files\DVD Maker\de-DE\backup.exe
                                      "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1912
                                    • C:\Program Files\DVD Maker\en-US\backup.exe
                                      "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Suspicious use of SetWindowsHookEx
                                      PID:616
                                    • C:\Program Files\DVD Maker\es-ES\backup.exe
                                      "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1168
                                    • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                      "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                      6⤵
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1352
                                    • C:\Program Files\DVD Maker\it-IT\backup.exe
                                      "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                      6⤵
                                        PID:268
                                      • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                        "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                        6⤵
                                          PID:1356
                                        • C:\Program Files\DVD Maker\Shared\backup.exe
                                          "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                          6⤵
                                            PID:592
                                        • C:\Program Files\Google\backup.exe
                                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                          5⤵
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          PID:820
                                        • C:\Program Files\Internet Explorer\backup.exe
                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:760
                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                            6⤵
                                              PID:1184
                                            • C:\Program Files\Internet Explorer\en-US\backup.exe
                                              "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                              6⤵
                                                PID:1752
                                              • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                6⤵
                                                  PID:1996
                                                • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                  "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                  6⤵
                                                    PID:392
                                                  • C:\Program Files\Internet Explorer\images\System Restore.exe
                                                    "C:\Program Files\Internet Explorer\images\System Restore.exe" C:\Program Files\Internet Explorer\images\
                                                    6⤵
                                                      PID:788
                                                  • C:\Program Files\Java\backup.exe
                                                    "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:2008
                                                    • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                      "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                      6⤵
                                                        PID:1928
                                                      • C:\Program Files\Java\jre7\backup.exe
                                                        "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
                                                        6⤵
                                                          PID:1956
                                                      • C:\Program Files\Microsoft Games\backup.exe
                                                        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                        5⤵
                                                          PID:808
                                                          • C:\Program Files\Microsoft Games\Chess\backup.exe
                                                            "C:\Program Files\Microsoft Games\Chess\backup.exe" C:\Program Files\Microsoft Games\Chess\
                                                            6⤵
                                                              PID:1740
                                                            • C:\Program Files\Microsoft Games\FreeCell\System Restore.exe
                                                              "C:\Program Files\Microsoft Games\FreeCell\System Restore.exe" C:\Program Files\Microsoft Games\FreeCell\
                                                              6⤵
                                                                PID:856
                                                            • C:\Program Files\Microsoft Office\data.exe
                                                              "C:\Program Files\Microsoft Office\data.exe" C:\Program Files\Microsoft Office\
                                                              5⤵
                                                                PID:616
                                                              • C:\Program Files\Mozilla Firefox\backup.exe
                                                                "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                5⤵
                                                                  PID:1372
                                                                • C:\Program Files\MSBuild\backup.exe
                                                                  "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
                                                                  5⤵
                                                                    PID:756
                                                                  • C:\Program Files\Reference Assemblies\backup.exe
                                                                    "C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\
                                                                    5⤵
                                                                      PID:1316
                                                                  • C:\Program Files (x86)\backup.exe
                                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                    4⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    • System policy modification
                                                                    PID:668
                                                                    • C:\Program Files (x86)\Adobe\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                      5⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Disables RegEdit via registry modification
                                                                      • Executes dropped EXE
                                                                      • Loads dropped DLL
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:2032
                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                        6⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Disables RegEdit via registry modification
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        • System policy modification
                                                                        PID:1436
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1508
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                          7⤵
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1812
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                          7⤵
                                                                            PID:1624
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                              8⤵
                                                                                PID:2032
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                              7⤵
                                                                                PID:1608
                                                                          • C:\Program Files (x86)\Common Files\backup.exe
                                                                            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1804
                                                                          • C:\Program Files (x86)\Google\backup.exe
                                                                            "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                            5⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1008
                                                                          • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                            "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                            5⤵
                                                                              PID:1856
                                                                              • C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe
                                                                                "C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\
                                                                                6⤵
                                                                                  PID:1612
                                                                                • C:\Program Files (x86)\Internet Explorer\en-US\backup.exe
                                                                                  "C:\Program Files (x86)\Internet Explorer\en-US\backup.exe" C:\Program Files (x86)\Internet Explorer\en-US\
                                                                                  6⤵
                                                                                    PID:1684
                                                                                  • C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe
                                                                                    "C:\Program Files (x86)\Internet Explorer\es-ES\backup.exe" C:\Program Files (x86)\Internet Explorer\es-ES\
                                                                                    6⤵
                                                                                      PID:1504
                                                                                  • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                    "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                    5⤵
                                                                                      PID:980
                                                                                    • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                      "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                      5⤵
                                                                                        PID:608
                                                                                      • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                        "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                        5⤵
                                                                                          PID:912
                                                                                        • C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
                                                                                          "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                          5⤵
                                                                                            PID:1304
                                                                                        • C:\Users\backup.exe
                                                                                          C:\Users\backup.exe C:\Users\
                                                                                          4⤵
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:384
                                                                                        • C:\Windows\backup.exe
                                                                                          C:\Windows\backup.exe C:\Windows\
                                                                                          4⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          • System policy modification
                                                                                          PID:2012
                                                                                          • C:\Windows\addins\backup.exe
                                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                            5⤵
                                                                                              PID:1084
                                                                                            • C:\Windows\AppCompat\backup.exe
                                                                                              C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                              5⤵
                                                                                                PID:540
                                                                                              • C:\Windows\AppPatch\backup.exe
                                                                                                C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                                5⤵
                                                                                                  PID:1620
                                                                                                • C:\Windows\assembly\backup.exe
                                                                                                  C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                                  5⤵
                                                                                                    PID:1640
                                                                                                  • C:\Windows\Branding\backup.exe
                                                                                                    C:\Windows\Branding\backup.exe C:\Windows\Branding\
                                                                                                    5⤵
                                                                                                      PID:1548
                                                                                              • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                2⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1708
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                2⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                PID:1688
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                2⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1012
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                2⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1412
                                                                                              • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                2⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1316
                                                                                              • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                2⤵
                                                                                                • Modifies visibility of file extensions in Explorer
                                                                                                • Disables RegEdit via registry modification
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                • System policy modification
                                                                                                PID:1260

                                                                                            Network

                                                                                            MITRE ATT&CK Enterprise v6

                                                                                            Replay Monitor

                                                                                            Loading Replay Monitor...

                                                                                            Downloads

                                                                                            • C:\PerfLogs\Admin\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3bbd97c4ba3519b434bbf0f664491de0

                                                                                              SHA1

                                                                                              f7c9da58e11627047b819044e48f782519b1b7f5

                                                                                              SHA256

                                                                                              8c57cc6acb8778120e09632ab966b5e1eec4cbc1cbf257138b98fb76df186959

                                                                                              SHA512

                                                                                              60ba5e941a6f044777400b31bad60128edccaa8e9e9286cc6e815154feea3ebf27fd9dba97058e09ef913c86235ef978b1e8b09983ac9e9dfddf822aab4e69ca

                                                                                            • C:\PerfLogs\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              0addc95be4e05f88b7937465eb405138

                                                                                              SHA1

                                                                                              c1fcc3e7c126fa84013e1d5d9917cde29b928bcd

                                                                                              SHA256

                                                                                              aeb6483033575536386ecd77e109d5ea0dc8e48777760c53d7e5ae6698b3ee9b

                                                                                              SHA512

                                                                                              4fa43ce4c6e2388d4af22c6313d77c59ed3bc0d4b263fe61b9f7a214952a6c90432631bab76d92dda59c4129d502edc4aa8bc2c686196264c64b7a4b6875699e

                                                                                            • C:\PerfLogs\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              0addc95be4e05f88b7937465eb405138

                                                                                              SHA1

                                                                                              c1fcc3e7c126fa84013e1d5d9917cde29b928bcd

                                                                                              SHA256

                                                                                              aeb6483033575536386ecd77e109d5ea0dc8e48777760c53d7e5ae6698b3ee9b

                                                                                              SHA512

                                                                                              4fa43ce4c6e2388d4af22c6313d77c59ed3bc0d4b263fe61b9f7a214952a6c90432631bab76d92dda59c4129d502edc4aa8bc2c686196264c64b7a4b6875699e

                                                                                            • C:\Program Files (x86)\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              a7f7af04ae23c0b90acc3ba850f5b6c6

                                                                                              SHA1

                                                                                              d27bc5b40c29547eaf733f84101d0fa89b524f75

                                                                                              SHA256

                                                                                              7bae7cd224bd03d63b12c1c764c5c5a3ed3648539086bf201cba2eb7666e951b

                                                                                              SHA512

                                                                                              e02e97596631e36d48afe2e65ecc937708471526d961dcb7eb2666fb4fc740bb7c90f5f3bcc270e1df407ac8d3c3a807e73258f2ea2e4821049ae12bb7a76742

                                                                                            • C:\Program Files (x86)\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              a7f7af04ae23c0b90acc3ba850f5b6c6

                                                                                              SHA1

                                                                                              d27bc5b40c29547eaf733f84101d0fa89b524f75

                                                                                              SHA256

                                                                                              7bae7cd224bd03d63b12c1c764c5c5a3ed3648539086bf201cba2eb7666e951b

                                                                                              SHA512

                                                                                              e02e97596631e36d48afe2e65ecc937708471526d961dcb7eb2666fb4fc740bb7c90f5f3bcc270e1df407ac8d3c3a807e73258f2ea2e4821049ae12bb7a76742

                                                                                            • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              62b5ee70422b2045e0012f6f26b116ff

                                                                                              SHA1

                                                                                              f3e3f89aceafec9e0dd400e65ef5e4ef5ae35499

                                                                                              SHA256

                                                                                              2f48ba5542a988047fa974ff48d8d51e4fd53b82e5fc1b038e65fdc62d10071a

                                                                                              SHA512

                                                                                              ab1bf882a3a9a2e1d2246b0de7dd02aa56011529b32ae505707941d2c70e82a3f0c6ab663204bd5ee6bee179e7e19fd7e621208c6aa53c9e376a704dccb40a58

                                                                                            • C:\Program Files\7-Zip\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3f5b6683cf463a36737bdc2dc949e43c

                                                                                              SHA1

                                                                                              c2a365f38fb9b02876bf754d530304d989d13bc8

                                                                                              SHA256

                                                                                              bebe9f15a984d6bd797b7df7a8f1cec81b92ce4bd1fd5ee87a7f6c5e11d5da8b

                                                                                              SHA512

                                                                                              0d53300cb70af131aba1a99c878ab39b43ceec6fe423454234312cf21ed6d6b9ea794390012a073dec282ba307fcf18f472eb828a7c53d4eea99a12ce42e5d10

                                                                                            • C:\Program Files\7-Zip\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3f5b6683cf463a36737bdc2dc949e43c

                                                                                              SHA1

                                                                                              c2a365f38fb9b02876bf754d530304d989d13bc8

                                                                                              SHA256

                                                                                              bebe9f15a984d6bd797b7df7a8f1cec81b92ce4bd1fd5ee87a7f6c5e11d5da8b

                                                                                              SHA512

                                                                                              0d53300cb70af131aba1a99c878ab39b43ceec6fe423454234312cf21ed6d6b9ea794390012a073dec282ba307fcf18f472eb828a7c53d4eea99a12ce42e5d10

                                                                                            • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              c333f6d4153ac63f568aad26016810b1

                                                                                              SHA1

                                                                                              31707a71334f7bd22575e0752900db3db446ccb5

                                                                                              SHA256

                                                                                              35fee0e2a3a68afa541106d296be684b1c1109738d6d05e4800371563ebb7965

                                                                                              SHA512

                                                                                              0f23f9e277311e65e88f3c5c382d4db8eed511db096cfa4c92994ecfc9b783126328016fb5592e77065643907b671b95a5c5622e900cb542acce416e7d60dcc4

                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              d5d4ac5098e5c526961f978bc4300e05

                                                                                              SHA1

                                                                                              e8d3c1ab93ec58cd0e1a124ff41b4ae41cef178d

                                                                                              SHA256

                                                                                              520c39686dd4bbfebba0256270147a8b8f7571b1655e8aafd7023276568c24d2

                                                                                              SHA512

                                                                                              f52b74d5076672508e4a9cc03fe7c20b5f25ead081d9200c52fec273254f8e0937b75ca51d43b1e7e58354f07cc3432b4b673303fadf27cb94e1802f400a9833

                                                                                            • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              d5d4ac5098e5c526961f978bc4300e05

                                                                                              SHA1

                                                                                              e8d3c1ab93ec58cd0e1a124ff41b4ae41cef178d

                                                                                              SHA256

                                                                                              520c39686dd4bbfebba0256270147a8b8f7571b1655e8aafd7023276568c24d2

                                                                                              SHA512

                                                                                              f52b74d5076672508e4a9cc03fe7c20b5f25ead081d9200c52fec273254f8e0937b75ca51d43b1e7e58354f07cc3432b4b673303fadf27cb94e1802f400a9833

                                                                                            • C:\Program Files\Common Files\Services\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              ccad94eeacb723fcef1cf74eeaa53a0f

                                                                                              SHA1

                                                                                              510c74ae89ca9f4ef88fba07375442889967f26d

                                                                                              SHA256

                                                                                              58ad732e5b005c17e973fffa70667c7cab6f13374a0ea9291b112adb3fc46ff3

                                                                                              SHA512

                                                                                              1d62635dbe58d25fd19efbc2af3c9ffff3dc09fd8abcf8325524e715bda7c5cf90b9ad5037e0ff492cfa146193074205ecb2d7342450d7871ef4a347f0be570f

                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              05597434b253d00f6182692d417aa348

                                                                                              SHA1

                                                                                              d8faabd379c62e8c1eaf767b93b467cd3f57ccbd

                                                                                              SHA256

                                                                                              ad974e4e022a172ed464c84ea755eb52bd46ec8fe4df2881fb7adcbf20400915

                                                                                              SHA512

                                                                                              7ecad61720bbb869e2d2d23081f7b22cdbcec368d68dd0abf4ac720e7b30fc19ed015e0540034973a25d3c040176c4c411532710e4d14537f16a5e04b7979ea9

                                                                                            • C:\Program Files\Common Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              05597434b253d00f6182692d417aa348

                                                                                              SHA1

                                                                                              d8faabd379c62e8c1eaf767b93b467cd3f57ccbd

                                                                                              SHA256

                                                                                              ad974e4e022a172ed464c84ea755eb52bd46ec8fe4df2881fb7adcbf20400915

                                                                                              SHA512

                                                                                              7ecad61720bbb869e2d2d23081f7b22cdbcec368d68dd0abf4ac720e7b30fc19ed015e0540034973a25d3c040176c4c411532710e4d14537f16a5e04b7979ea9

                                                                                            • C:\Program Files\DVD Maker\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              71bf9f4f315f55d84ab1bb48fd05d7cd

                                                                                              SHA1

                                                                                              2459d78d9848164c691a280904492039e4a90c79

                                                                                              SHA256

                                                                                              fe10f9c83484cdade3ad3b7c796ae3074c53d16409efcc5c29672e4391fe5ac1

                                                                                              SHA512

                                                                                              55859d24e9db8e2eac313c01b821ba20068eb67c47af40d09b46624d3407ee2994eff5ce402097f6568a318feed69bb4dc2cd6dfe3d844203ed277745357aef5

                                                                                            • C:\Program Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              383b0d30aeca94225243af8628a978cf

                                                                                              SHA1

                                                                                              7038f244d8bacbf8176f0d084dc29cec2b02dfb1

                                                                                              SHA256

                                                                                              00f46354f44a13bde2fb19abec78f156b3c6ce3303eff173998076daf7574ead

                                                                                              SHA512

                                                                                              07f65a34cce0ba6f547f2ddcf6f7239cd3dfbcc544d02435df977c7837683f5ce4743948cba8d733fc5e499d9854ab9544023680cc7491d4500a76e37f2fe345

                                                                                            • C:\Program Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              383b0d30aeca94225243af8628a978cf

                                                                                              SHA1

                                                                                              7038f244d8bacbf8176f0d084dc29cec2b02dfb1

                                                                                              SHA256

                                                                                              00f46354f44a13bde2fb19abec78f156b3c6ce3303eff173998076daf7574ead

                                                                                              SHA512

                                                                                              07f65a34cce0ba6f547f2ddcf6f7239cd3dfbcc544d02435df977c7837683f5ce4743948cba8d733fc5e499d9854ab9544023680cc7491d4500a76e37f2fe345

                                                                                            • C:\Users\Admin\AppData\Local\Temp\352603670\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • C:\Users\Admin\AppData\Local\Temp\352603670\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • C:\Users\Admin\AppData\Local\Temp\Low\System Restore.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              9a70f3b510e4867585e47d76609e76f1

                                                                                              SHA1

                                                                                              5ef2a0542a97d2c81274cf0890684da1444908da

                                                                                              SHA256

                                                                                              23a21ce97bba03af6757f700356baa9b6ef5c3e587a92bbd1ca933aa237922ad

                                                                                              SHA512

                                                                                              123109b3b58c614b061c82b8d8351a6308c444fe6d0eebc23b3a6436cb7363236266179773047436c0388000983386d7e3239aa45153c774a69fd9c7b40b59dd

                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              bd229c5546340fc5f2f387eeecc6e7df

                                                                                              SHA1

                                                                                              a48d8b8b09da86dff6639ceb787f164fc0e12610

                                                                                              SHA256

                                                                                              3dc9aaf8897db1cbba3e76867bbdc8a3f21d98db61f9127beb564dda1edf282a

                                                                                              SHA512

                                                                                              18441f0d45b456f8327aad29f4439b6693eaa3e6812a39339a6070740cd4ccabf4ee9b643b10a79beabe07555ad8f33f98a080af5ac36dbd2ef3d8896475500e

                                                                                            • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              bd229c5546340fc5f2f387eeecc6e7df

                                                                                              SHA1

                                                                                              a48d8b8b09da86dff6639ceb787f164fc0e12610

                                                                                              SHA256

                                                                                              3dc9aaf8897db1cbba3e76867bbdc8a3f21d98db61f9127beb564dda1edf282a

                                                                                              SHA512

                                                                                              18441f0d45b456f8327aad29f4439b6693eaa3e6812a39339a6070740cd4ccabf4ee9b643b10a79beabe07555ad8f33f98a080af5ac36dbd2ef3d8896475500e

                                                                                            • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              18c6edba3670704c7ff19f08ccf4ec55

                                                                                              SHA1

                                                                                              3cfead380debd1f5822c3f2199ae0c2a8055fb03

                                                                                              SHA256

                                                                                              d2b5a141c780ccb9f8765f9601ec113f8bdb9af5f7018b3702a343c399dbf16d

                                                                                              SHA512

                                                                                              ec768040ee37be5c247c398884d430b5fbfb5d908c93a369da038a9beb6aaeece5c6809e94456a85d8e42a72fa7f8429b89d7c805dd28ee8786d2b0bf9aa004b

                                                                                            • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              18c6edba3670704c7ff19f08ccf4ec55

                                                                                              SHA1

                                                                                              3cfead380debd1f5822c3f2199ae0c2a8055fb03

                                                                                              SHA256

                                                                                              d2b5a141c780ccb9f8765f9601ec113f8bdb9af5f7018b3702a343c399dbf16d

                                                                                              SHA512

                                                                                              ec768040ee37be5c247c398884d430b5fbfb5d908c93a369da038a9beb6aaeece5c6809e94456a85d8e42a72fa7f8429b89d7c805dd28ee8786d2b0bf9aa004b

                                                                                            • C:\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              2b6e86b88777e7047ae9ccf4923cf62d

                                                                                              SHA1

                                                                                              e954797aec3ba9541be677a427d1b568b3424dc2

                                                                                              SHA256

                                                                                              5236c667ec13752b0614d2d135756b49139eabc9bac1621d0e398a627cdb3148

                                                                                              SHA512

                                                                                              6aa2695a7abc64e9a00fe1ea5f8bada5ae6f482ad98e50c494a1604fc7a818aac66e77b33838a811ac0b66d2fba6a88d2d700e28f4220663fcc703fe9bde7415

                                                                                            • C:\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              2b6e86b88777e7047ae9ccf4923cf62d

                                                                                              SHA1

                                                                                              e954797aec3ba9541be677a427d1b568b3424dc2

                                                                                              SHA256

                                                                                              5236c667ec13752b0614d2d135756b49139eabc9bac1621d0e398a627cdb3148

                                                                                              SHA512

                                                                                              6aa2695a7abc64e9a00fe1ea5f8bada5ae6f482ad98e50c494a1604fc7a818aac66e77b33838a811ac0b66d2fba6a88d2d700e28f4220663fcc703fe9bde7415

                                                                                            • \PerfLogs\Admin\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3bbd97c4ba3519b434bbf0f664491de0

                                                                                              SHA1

                                                                                              f7c9da58e11627047b819044e48f782519b1b7f5

                                                                                              SHA256

                                                                                              8c57cc6acb8778120e09632ab966b5e1eec4cbc1cbf257138b98fb76df186959

                                                                                              SHA512

                                                                                              60ba5e941a6f044777400b31bad60128edccaa8e9e9286cc6e815154feea3ebf27fd9dba97058e09ef913c86235ef978b1e8b09983ac9e9dfddf822aab4e69ca

                                                                                            • \PerfLogs\Admin\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3bbd97c4ba3519b434bbf0f664491de0

                                                                                              SHA1

                                                                                              f7c9da58e11627047b819044e48f782519b1b7f5

                                                                                              SHA256

                                                                                              8c57cc6acb8778120e09632ab966b5e1eec4cbc1cbf257138b98fb76df186959

                                                                                              SHA512

                                                                                              60ba5e941a6f044777400b31bad60128edccaa8e9e9286cc6e815154feea3ebf27fd9dba97058e09ef913c86235ef978b1e8b09983ac9e9dfddf822aab4e69ca

                                                                                            • \PerfLogs\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              0addc95be4e05f88b7937465eb405138

                                                                                              SHA1

                                                                                              c1fcc3e7c126fa84013e1d5d9917cde29b928bcd

                                                                                              SHA256

                                                                                              aeb6483033575536386ecd77e109d5ea0dc8e48777760c53d7e5ae6698b3ee9b

                                                                                              SHA512

                                                                                              4fa43ce4c6e2388d4af22c6313d77c59ed3bc0d4b263fe61b9f7a214952a6c90432631bab76d92dda59c4129d502edc4aa8bc2c686196264c64b7a4b6875699e

                                                                                            • \PerfLogs\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              0addc95be4e05f88b7937465eb405138

                                                                                              SHA1

                                                                                              c1fcc3e7c126fa84013e1d5d9917cde29b928bcd

                                                                                              SHA256

                                                                                              aeb6483033575536386ecd77e109d5ea0dc8e48777760c53d7e5ae6698b3ee9b

                                                                                              SHA512

                                                                                              4fa43ce4c6e2388d4af22c6313d77c59ed3bc0d4b263fe61b9f7a214952a6c90432631bab76d92dda59c4129d502edc4aa8bc2c686196264c64b7a4b6875699e

                                                                                            • \Program Files (x86)\Adobe\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              1f36a09ac2c043f1caa986b9bb4f130c

                                                                                              SHA1

                                                                                              bec6128040783612f1a9650fe4d4bc5bfe655246

                                                                                              SHA256

                                                                                              70bb01a302e291c339d6b0bfd2a92d48d621bf4ed4845adc7c5ecd8a301a9414

                                                                                              SHA512

                                                                                              7dec4954eeffd25e8b6565e06d65240e109e90b1e351abc7949828891eb707b6bc49686ff04dee09cd3829fb7ecba9acfe829bf0f01354d44ec73edef968f9d0

                                                                                            • \Program Files (x86)\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              a7f7af04ae23c0b90acc3ba850f5b6c6

                                                                                              SHA1

                                                                                              d27bc5b40c29547eaf733f84101d0fa89b524f75

                                                                                              SHA256

                                                                                              7bae7cd224bd03d63b12c1c764c5c5a3ed3648539086bf201cba2eb7666e951b

                                                                                              SHA512

                                                                                              e02e97596631e36d48afe2e65ecc937708471526d961dcb7eb2666fb4fc740bb7c90f5f3bcc270e1df407ac8d3c3a807e73258f2ea2e4821049ae12bb7a76742

                                                                                            • \Program Files (x86)\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              a7f7af04ae23c0b90acc3ba850f5b6c6

                                                                                              SHA1

                                                                                              d27bc5b40c29547eaf733f84101d0fa89b524f75

                                                                                              SHA256

                                                                                              7bae7cd224bd03d63b12c1c764c5c5a3ed3648539086bf201cba2eb7666e951b

                                                                                              SHA512

                                                                                              e02e97596631e36d48afe2e65ecc937708471526d961dcb7eb2666fb4fc740bb7c90f5f3bcc270e1df407ac8d3c3a807e73258f2ea2e4821049ae12bb7a76742

                                                                                            • \Program Files\7-Zip\Lang\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              62b5ee70422b2045e0012f6f26b116ff

                                                                                              SHA1

                                                                                              f3e3f89aceafec9e0dd400e65ef5e4ef5ae35499

                                                                                              SHA256

                                                                                              2f48ba5542a988047fa974ff48d8d51e4fd53b82e5fc1b038e65fdc62d10071a

                                                                                              SHA512

                                                                                              ab1bf882a3a9a2e1d2246b0de7dd02aa56011529b32ae505707941d2c70e82a3f0c6ab663204bd5ee6bee179e7e19fd7e621208c6aa53c9e376a704dccb40a58

                                                                                            • \Program Files\7-Zip\Lang\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              62b5ee70422b2045e0012f6f26b116ff

                                                                                              SHA1

                                                                                              f3e3f89aceafec9e0dd400e65ef5e4ef5ae35499

                                                                                              SHA256

                                                                                              2f48ba5542a988047fa974ff48d8d51e4fd53b82e5fc1b038e65fdc62d10071a

                                                                                              SHA512

                                                                                              ab1bf882a3a9a2e1d2246b0de7dd02aa56011529b32ae505707941d2c70e82a3f0c6ab663204bd5ee6bee179e7e19fd7e621208c6aa53c9e376a704dccb40a58

                                                                                            • \Program Files\7-Zip\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3f5b6683cf463a36737bdc2dc949e43c

                                                                                              SHA1

                                                                                              c2a365f38fb9b02876bf754d530304d989d13bc8

                                                                                              SHA256

                                                                                              bebe9f15a984d6bd797b7df7a8f1cec81b92ce4bd1fd5ee87a7f6c5e11d5da8b

                                                                                              SHA512

                                                                                              0d53300cb70af131aba1a99c878ab39b43ceec6fe423454234312cf21ed6d6b9ea794390012a073dec282ba307fcf18f472eb828a7c53d4eea99a12ce42e5d10

                                                                                            • \Program Files\7-Zip\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              3f5b6683cf463a36737bdc2dc949e43c

                                                                                              SHA1

                                                                                              c2a365f38fb9b02876bf754d530304d989d13bc8

                                                                                              SHA256

                                                                                              bebe9f15a984d6bd797b7df7a8f1cec81b92ce4bd1fd5ee87a7f6c5e11d5da8b

                                                                                              SHA512

                                                                                              0d53300cb70af131aba1a99c878ab39b43ceec6fe423454234312cf21ed6d6b9ea794390012a073dec282ba307fcf18f472eb828a7c53d4eea99a12ce42e5d10

                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              c333f6d4153ac63f568aad26016810b1

                                                                                              SHA1

                                                                                              31707a71334f7bd22575e0752900db3db446ccb5

                                                                                              SHA256

                                                                                              35fee0e2a3a68afa541106d296be684b1c1109738d6d05e4800371563ebb7965

                                                                                              SHA512

                                                                                              0f23f9e277311e65e88f3c5c382d4db8eed511db096cfa4c92994ecfc9b783126328016fb5592e77065643907b671b95a5c5622e900cb542acce416e7d60dcc4

                                                                                            • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              c333f6d4153ac63f568aad26016810b1

                                                                                              SHA1

                                                                                              31707a71334f7bd22575e0752900db3db446ccb5

                                                                                              SHA256

                                                                                              35fee0e2a3a68afa541106d296be684b1c1109738d6d05e4800371563ebb7965

                                                                                              SHA512

                                                                                              0f23f9e277311e65e88f3c5c382d4db8eed511db096cfa4c92994ecfc9b783126328016fb5592e77065643907b671b95a5c5622e900cb542acce416e7d60dcc4

                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              d5d4ac5098e5c526961f978bc4300e05

                                                                                              SHA1

                                                                                              e8d3c1ab93ec58cd0e1a124ff41b4ae41cef178d

                                                                                              SHA256

                                                                                              520c39686dd4bbfebba0256270147a8b8f7571b1655e8aafd7023276568c24d2

                                                                                              SHA512

                                                                                              f52b74d5076672508e4a9cc03fe7c20b5f25ead081d9200c52fec273254f8e0937b75ca51d43b1e7e58354f07cc3432b4b673303fadf27cb94e1802f400a9833

                                                                                            • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              d5d4ac5098e5c526961f978bc4300e05

                                                                                              SHA1

                                                                                              e8d3c1ab93ec58cd0e1a124ff41b4ae41cef178d

                                                                                              SHA256

                                                                                              520c39686dd4bbfebba0256270147a8b8f7571b1655e8aafd7023276568c24d2

                                                                                              SHA512

                                                                                              f52b74d5076672508e4a9cc03fe7c20b5f25ead081d9200c52fec273254f8e0937b75ca51d43b1e7e58354f07cc3432b4b673303fadf27cb94e1802f400a9833

                                                                                            • \Program Files\Common Files\Services\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              ccad94eeacb723fcef1cf74eeaa53a0f

                                                                                              SHA1

                                                                                              510c74ae89ca9f4ef88fba07375442889967f26d

                                                                                              SHA256

                                                                                              58ad732e5b005c17e973fffa70667c7cab6f13374a0ea9291b112adb3fc46ff3

                                                                                              SHA512

                                                                                              1d62635dbe58d25fd19efbc2af3c9ffff3dc09fd8abcf8325524e715bda7c5cf90b9ad5037e0ff492cfa146193074205ecb2d7342450d7871ef4a347f0be570f

                                                                                            • \Program Files\Common Files\Services\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              ccad94eeacb723fcef1cf74eeaa53a0f

                                                                                              SHA1

                                                                                              510c74ae89ca9f4ef88fba07375442889967f26d

                                                                                              SHA256

                                                                                              58ad732e5b005c17e973fffa70667c7cab6f13374a0ea9291b112adb3fc46ff3

                                                                                              SHA512

                                                                                              1d62635dbe58d25fd19efbc2af3c9ffff3dc09fd8abcf8325524e715bda7c5cf90b9ad5037e0ff492cfa146193074205ecb2d7342450d7871ef4a347f0be570f

                                                                                            • \Program Files\Common Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              05597434b253d00f6182692d417aa348

                                                                                              SHA1

                                                                                              d8faabd379c62e8c1eaf767b93b467cd3f57ccbd

                                                                                              SHA256

                                                                                              ad974e4e022a172ed464c84ea755eb52bd46ec8fe4df2881fb7adcbf20400915

                                                                                              SHA512

                                                                                              7ecad61720bbb869e2d2d23081f7b22cdbcec368d68dd0abf4ac720e7b30fc19ed015e0540034973a25d3c040176c4c411532710e4d14537f16a5e04b7979ea9

                                                                                            • \Program Files\Common Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              05597434b253d00f6182692d417aa348

                                                                                              SHA1

                                                                                              d8faabd379c62e8c1eaf767b93b467cd3f57ccbd

                                                                                              SHA256

                                                                                              ad974e4e022a172ed464c84ea755eb52bd46ec8fe4df2881fb7adcbf20400915

                                                                                              SHA512

                                                                                              7ecad61720bbb869e2d2d23081f7b22cdbcec368d68dd0abf4ac720e7b30fc19ed015e0540034973a25d3c040176c4c411532710e4d14537f16a5e04b7979ea9

                                                                                            • \Program Files\DVD Maker\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              71bf9f4f315f55d84ab1bb48fd05d7cd

                                                                                              SHA1

                                                                                              2459d78d9848164c691a280904492039e4a90c79

                                                                                              SHA256

                                                                                              fe10f9c83484cdade3ad3b7c796ae3074c53d16409efcc5c29672e4391fe5ac1

                                                                                              SHA512

                                                                                              55859d24e9db8e2eac313c01b821ba20068eb67c47af40d09b46624d3407ee2994eff5ce402097f6568a318feed69bb4dc2cd6dfe3d844203ed277745357aef5

                                                                                            • \Program Files\DVD Maker\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              71bf9f4f315f55d84ab1bb48fd05d7cd

                                                                                              SHA1

                                                                                              2459d78d9848164c691a280904492039e4a90c79

                                                                                              SHA256

                                                                                              fe10f9c83484cdade3ad3b7c796ae3074c53d16409efcc5c29672e4391fe5ac1

                                                                                              SHA512

                                                                                              55859d24e9db8e2eac313c01b821ba20068eb67c47af40d09b46624d3407ee2994eff5ce402097f6568a318feed69bb4dc2cd6dfe3d844203ed277745357aef5

                                                                                            • \Program Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              383b0d30aeca94225243af8628a978cf

                                                                                              SHA1

                                                                                              7038f244d8bacbf8176f0d084dc29cec2b02dfb1

                                                                                              SHA256

                                                                                              00f46354f44a13bde2fb19abec78f156b3c6ce3303eff173998076daf7574ead

                                                                                              SHA512

                                                                                              07f65a34cce0ba6f547f2ddcf6f7239cd3dfbcc544d02435df977c7837683f5ce4743948cba8d733fc5e499d9854ab9544023680cc7491d4500a76e37f2fe345

                                                                                            • \Program Files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              383b0d30aeca94225243af8628a978cf

                                                                                              SHA1

                                                                                              7038f244d8bacbf8176f0d084dc29cec2b02dfb1

                                                                                              SHA256

                                                                                              00f46354f44a13bde2fb19abec78f156b3c6ce3303eff173998076daf7574ead

                                                                                              SHA512

                                                                                              07f65a34cce0ba6f547f2ddcf6f7239cd3dfbcc544d02435df977c7837683f5ce4743948cba8d733fc5e499d9854ab9544023680cc7491d4500a76e37f2fe345

                                                                                            • \Users\Admin\AppData\Local\Temp\352603670\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • \Users\Admin\AppData\Local\Temp\352603670\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • \Users\Admin\AppData\Local\Temp\Low\System Restore.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              9a70f3b510e4867585e47d76609e76f1

                                                                                              SHA1

                                                                                              5ef2a0542a97d2c81274cf0890684da1444908da

                                                                                              SHA256

                                                                                              23a21ce97bba03af6757f700356baa9b6ef5c3e587a92bbd1ca933aa237922ad

                                                                                              SHA512

                                                                                              123109b3b58c614b061c82b8d8351a6308c444fe6d0eebc23b3a6436cb7363236266179773047436c0388000983386d7e3239aa45153c774a69fd9c7b40b59dd

                                                                                            • \Users\Admin\AppData\Local\Temp\Low\System Restore.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              9a70f3b510e4867585e47d76609e76f1

                                                                                              SHA1

                                                                                              5ef2a0542a97d2c81274cf0890684da1444908da

                                                                                              SHA256

                                                                                              23a21ce97bba03af6757f700356baa9b6ef5c3e587a92bbd1ca933aa237922ad

                                                                                              SHA512

                                                                                              123109b3b58c614b061c82b8d8351a6308c444fe6d0eebc23b3a6436cb7363236266179773047436c0388000983386d7e3239aa45153c774a69fd9c7b40b59dd

                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              bd229c5546340fc5f2f387eeecc6e7df

                                                                                              SHA1

                                                                                              a48d8b8b09da86dff6639ceb787f164fc0e12610

                                                                                              SHA256

                                                                                              3dc9aaf8897db1cbba3e76867bbdc8a3f21d98db61f9127beb564dda1edf282a

                                                                                              SHA512

                                                                                              18441f0d45b456f8327aad29f4439b6693eaa3e6812a39339a6070740cd4ccabf4ee9b643b10a79beabe07555ad8f33f98a080af5ac36dbd2ef3d8896475500e

                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              bd229c5546340fc5f2f387eeecc6e7df

                                                                                              SHA1

                                                                                              a48d8b8b09da86dff6639ceb787f164fc0e12610

                                                                                              SHA256

                                                                                              3dc9aaf8897db1cbba3e76867bbdc8a3f21d98db61f9127beb564dda1edf282a

                                                                                              SHA512

                                                                                              18441f0d45b456f8327aad29f4439b6693eaa3e6812a39339a6070740cd4ccabf4ee9b643b10a79beabe07555ad8f33f98a080af5ac36dbd2ef3d8896475500e

                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              bd229c5546340fc5f2f387eeecc6e7df

                                                                                              SHA1

                                                                                              a48d8b8b09da86dff6639ceb787f164fc0e12610

                                                                                              SHA256

                                                                                              3dc9aaf8897db1cbba3e76867bbdc8a3f21d98db61f9127beb564dda1edf282a

                                                                                              SHA512

                                                                                              18441f0d45b456f8327aad29f4439b6693eaa3e6812a39339a6070740cd4ccabf4ee9b643b10a79beabe07555ad8f33f98a080af5ac36dbd2ef3d8896475500e

                                                                                            • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              bd229c5546340fc5f2f387eeecc6e7df

                                                                                              SHA1

                                                                                              a48d8b8b09da86dff6639ceb787f164fc0e12610

                                                                                              SHA256

                                                                                              3dc9aaf8897db1cbba3e76867bbdc8a3f21d98db61f9127beb564dda1edf282a

                                                                                              SHA512

                                                                                              18441f0d45b456f8327aad29f4439b6693eaa3e6812a39339a6070740cd4ccabf4ee9b643b10a79beabe07555ad8f33f98a080af5ac36dbd2ef3d8896475500e

                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              18c6edba3670704c7ff19f08ccf4ec55

                                                                                              SHA1

                                                                                              3cfead380debd1f5822c3f2199ae0c2a8055fb03

                                                                                              SHA256

                                                                                              d2b5a141c780ccb9f8765f9601ec113f8bdb9af5f7018b3702a343c399dbf16d

                                                                                              SHA512

                                                                                              ec768040ee37be5c247c398884d430b5fbfb5d908c93a369da038a9beb6aaeece5c6809e94456a85d8e42a72fa7f8429b89d7c805dd28ee8786d2b0bf9aa004b

                                                                                            • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              18c6edba3670704c7ff19f08ccf4ec55

                                                                                              SHA1

                                                                                              3cfead380debd1f5822c3f2199ae0c2a8055fb03

                                                                                              SHA256

                                                                                              d2b5a141c780ccb9f8765f9601ec113f8bdb9af5f7018b3702a343c399dbf16d

                                                                                              SHA512

                                                                                              ec768040ee37be5c247c398884d430b5fbfb5d908c93a369da038a9beb6aaeece5c6809e94456a85d8e42a72fa7f8429b89d7c805dd28ee8786d2b0bf9aa004b

                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              cabda0e1316dccb9ec7359efd86d8715

                                                                                              SHA1

                                                                                              d945da4fb7f6cd0d3cf22b16dbef69a1b39e779a

                                                                                              SHA256

                                                                                              71ed0a22503d63dec2fb7bf33b3bf5c1bd4eff06619b567185dbb1229c5a3ef1

                                                                                              SHA512

                                                                                              2bf654d7ea156f8f12994e728e84ee03a0f8911089ca31791bcf4f34159d5cee90d869657587e6cb5ef43dc9fcc96ff6b54d4f8ff7fbbfc8cd51a5870c1e76d5

                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              18c6edba3670704c7ff19f08ccf4ec55

                                                                                              SHA1

                                                                                              3cfead380debd1f5822c3f2199ae0c2a8055fb03

                                                                                              SHA256

                                                                                              d2b5a141c780ccb9f8765f9601ec113f8bdb9af5f7018b3702a343c399dbf16d

                                                                                              SHA512

                                                                                              ec768040ee37be5c247c398884d430b5fbfb5d908c93a369da038a9beb6aaeece5c6809e94456a85d8e42a72fa7f8429b89d7c805dd28ee8786d2b0bf9aa004b

                                                                                            • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                                              Filesize

                                                                                              72KB

                                                                                              MD5

                                                                                              18c6edba3670704c7ff19f08ccf4ec55

                                                                                              SHA1

                                                                                              3cfead380debd1f5822c3f2199ae0c2a8055fb03

                                                                                              SHA256

                                                                                              d2b5a141c780ccb9f8765f9601ec113f8bdb9af5f7018b3702a343c399dbf16d

                                                                                              SHA512

                                                                                              ec768040ee37be5c247c398884d430b5fbfb5d908c93a369da038a9beb6aaeece5c6809e94456a85d8e42a72fa7f8429b89d7c805dd28ee8786d2b0bf9aa004b

                                                                                            • memory/1348-196-0x0000000073EF1000-0x0000000073EF3000-memory.dmp

                                                                                              Filesize

                                                                                              8KB

                                                                                            • memory/1348-131-0x0000000074AB1000-0x0000000074AB3000-memory.dmp

                                                                                              Filesize

                                                                                              8KB