Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 13:45

General

  • Target

    d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe

  • Size

    72KB

  • MD5

    0a32eedf4bce86003f384ed3f8f06891

  • SHA1

    29eb2b17ae55fe68229b5c74a8b74704e8da1ad3

  • SHA256

    d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac

  • SHA512

    0a74884def47123e713192fa59551cdda7a5ec3e58fb93b1fcbf03075bbcf1c81051a7f26a16a36c50d8e1293bca3c0a7670153fbc4f2ba296873a0a55215554

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf29:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPJ

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe
    "C:\Users\Admin\AppData\Local\Temp\d20ca679951558c4e71ba7e8968dab747e5aa2ef72e7b4c530207dd25f1331ac.exe"
    1⤵
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\1652623185\backup.exe
      C:\Users\Admin\AppData\Local\Temp\1652623185\backup.exe C:\Users\Admin\AppData\Local\Temp\1652623185\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:976
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1828
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:572
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1512
        • C:\Program Files\data.exe
          "C:\Program Files\data.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1712
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1760
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1084
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2012
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1740
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1752
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:936
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1472
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1080
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2044
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:660
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:760
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1692
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1488
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1468
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1548
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:552
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1496
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1572
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1704
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:968
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:684
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1040
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1680
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:2016
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1400
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1056
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1084
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:276
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1136
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1452
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1132
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:552
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:288
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:1820
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1472
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1332
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                    PID:1312
                  • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                    8⤵
                      PID:552
                    • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                      8⤵
                        PID:1252
                      • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                        8⤵
                          PID:812
                        • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                          8⤵
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:1548
                        • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                          8⤵
                            PID:1328
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                          7⤵
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:1108
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:964
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:108
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:676
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1352
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1952
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                            8⤵
                            • Disables RegEdit via registry modification
                            • System policy modification
                            PID:1396
                        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                          7⤵
                          • Disables RegEdit via registry modification
                          • Drops file in Program Files directory
                          PID:1336
                          • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                            8⤵
                              PID:1352
                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                            7⤵
                              PID:1132
                            • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                              7⤵
                                PID:1908
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                                7⤵
                                  PID:1128
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                  7⤵
                                    PID:756
                                  • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                    7⤵
                                      PID:1764
                                    • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                                      "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                                      7⤵
                                        PID:2060
                                    • C:\Program Files\Common Files\Services\backup.exe
                                      "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:956
                                    • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                      "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Suspicious use of SetWindowsHookEx
                                      PID:1200
                                      • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                        "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:1476
                                    • C:\Program Files\Common Files\System\backup.exe
                                      "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                      6⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      PID:540
                                      • C:\Program Files\Common Files\System\ado\backup.exe
                                        "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                        7⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        PID:1988
                                        • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1908
                                        • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          PID:1600
                                        • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                          "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • System policy modification
                                          PID:1192
                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                          8⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • System policy modification
                                          PID:760
                                        • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                          "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                          8⤵
                                            PID:596
                                          • C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
                                            "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
                                            8⤵
                                            • System policy modification
                                            PID:676
                                        • C:\Program Files\Common Files\System\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                          7⤵
                                            PID:1480
                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                            7⤵
                                              PID:788
                                            • C:\Program Files\Common Files\System\es-ES\backup.exe
                                              "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                              7⤵
                                                PID:1624
                                              • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                                "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                                7⤵
                                                  PID:744
                                                • C:\Program Files\Common Files\System\it-IT\backup.exe
                                                  "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
                                                  7⤵
                                                    PID:672
                                                  • C:\Program Files\Common Files\System\ja-JP\backup.exe
                                                    "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
                                                    7⤵
                                                      PID:1076
                                                • C:\Program Files\DVD Maker\backup.exe
                                                  "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                                  5⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Executes dropped EXE
                                                  • Drops file in Program Files directory
                                                  • Suspicious use of SetWindowsHookEx
                                                  PID:1916
                                                  • C:\Program Files\DVD Maker\de-DE\backup.exe
                                                    "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:520
                                                  • C:\Program Files\DVD Maker\en-US\backup.exe
                                                    "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1496
                                                  • C:\Program Files\DVD Maker\es-ES\update.exe
                                                    "C:\Program Files\DVD Maker\es-ES\update.exe" C:\Program Files\DVD Maker\es-ES\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • System policy modification
                                                    PID:1624
                                                  • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                                    "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:956
                                                  • C:\Program Files\DVD Maker\it-IT\backup.exe
                                                    "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                                    6⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • System policy modification
                                                    PID:1212
                                                  • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                    "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                    6⤵
                                                    • Disables RegEdit via registry modification
                                                    PID:1084
                                                  • C:\Program Files\DVD Maker\Shared\backup.exe
                                                    "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                                    6⤵
                                                      PID:1488
                                                      • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                        "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                        7⤵
                                                          PID:2112
                                                    • C:\Program Files\Google\backup.exe
                                                      "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                      5⤵
                                                        PID:964
                                                      • C:\Program Files\Internet Explorer\backup.exe
                                                        "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                        5⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Disables RegEdit via registry modification
                                                        • System policy modification
                                                        PID:1204
                                                        • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                          "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                          6⤵
                                                            PID:1880
                                                          • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                            "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                            6⤵
                                                              PID:892
                                                            • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                              "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                              6⤵
                                                                PID:1044
                                                            • C:\Program Files\Java\backup.exe
                                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                              5⤵
                                                                PID:1700
                                                              • C:\Program Files\Microsoft Games\backup.exe
                                                                "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                5⤵
                                                                  PID:1696
                                                                • C:\Program Files\Microsoft Office\backup.exe
                                                                  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                  5⤵
                                                                    PID:1200
                                                                  • C:\Program Files\Mozilla Firefox\backup.exe
                                                                    "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                                                                    5⤵
                                                                      PID:1600
                                                                  • C:\Program Files (x86)\backup.exe
                                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                    4⤵
                                                                    • Modifies visibility of file extensions in Explorer
                                                                    • Disables RegEdit via registry modification
                                                                    • Executes dropped EXE
                                                                    • Drops file in Program Files directory
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:852
                                                                    • C:\Program Files (x86)\Adobe\update.exe
                                                                      "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
                                                                      5⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:1484
                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                        6⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1596
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                          7⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Executes dropped EXE
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1620
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\data.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                          7⤵
                                                                          • Drops file in Program Files directory
                                                                          • System policy modification
                                                                          PID:1748
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                            8⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • System policy modification
                                                                            PID:1076
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                            8⤵
                                                                              PID:1548
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                              8⤵
                                                                                PID:1196
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                                8⤵
                                                                                  PID:1336
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                                  8⤵
                                                                                    PID:676
                                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                                  7⤵
                                                                                    PID:548
                                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
                                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
                                                                                      8⤵
                                                                                        PID:1648
                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
                                                                                        8⤵
                                                                                          PID:1988
                                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                        7⤵
                                                                                          PID:832
                                                                                    • C:\Program Files (x86)\Common Files\backup.exe
                                                                                      "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                                      5⤵
                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                      • Drops file in Program Files directory
                                                                                      PID:1640
                                                                                      • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                                                        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                                                        6⤵
                                                                                          PID:904
                                                                                        • C:\Program Files (x86)\Common Files\Adobe AIR\update.exe
                                                                                          "C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                                                          6⤵
                                                                                            PID:840
                                                                                          • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                                                            "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                                                            6⤵
                                                                                              PID:1620
                                                                                            • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                                              "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                                              6⤵
                                                                                                PID:1052
                                                                                              • C:\Program Files (x86)\Common Files\Services\backup.exe
                                                                                                "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
                                                                                                6⤵
                                                                                                  PID:1952
                                                                                                • C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
                                                                                                  "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
                                                                                                  6⤵
                                                                                                    PID:1156
                                                                                                • C:\Program Files (x86)\Google\backup.exe
                                                                                                  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                                  5⤵
                                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                                  • Disables RegEdit via registry modification
                                                                                                  • Drops file in Program Files directory
                                                                                                  PID:1540
                                                                                                  • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                                                    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                                                    6⤵
                                                                                                      PID:940
                                                                                                    • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                                                      "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                                                      6⤵
                                                                                                        PID:1920
                                                                                                      • C:\Program Files (x86)\Google\Temp\backup.exe
                                                                                                        "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
                                                                                                        6⤵
                                                                                                          PID:1616
                                                                                                        • C:\Program Files (x86)\Google\Update\update.exe
                                                                                                          "C:\Program Files (x86)\Google\Update\update.exe" C:\Program Files (x86)\Google\Update\
                                                                                                          6⤵
                                                                                                            PID:1040
                                                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                                                          5⤵
                                                                                                            PID:2044
                                                                                                          • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                                                            "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                                                            5⤵
                                                                                                              PID:1928
                                                                                                            • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                                                              "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                                                              5⤵
                                                                                                                PID:1820
                                                                                                              • C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe
                                                                                                                "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
                                                                                                                5⤵
                                                                                                                  PID:956
                                                                                                                • C:\Program Files (x86)\Microsoft Sync Framework\data.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft Sync Framework\data.exe" C:\Program Files (x86)\Microsoft Sync Framework\
                                                                                                                  5⤵
                                                                                                                    PID:2052
                                                                                                                • C:\Users\backup.exe
                                                                                                                  C:\Users\backup.exe C:\Users\
                                                                                                                  4⤵
                                                                                                                    PID:556
                                                                                                                  • C:\Windows\backup.exe
                                                                                                                    C:\Windows\backup.exe C:\Windows\
                                                                                                                    4⤵
                                                                                                                      PID:1680
                                                                                                                      • C:\Windows\addins\backup.exe
                                                                                                                        C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                                                                        5⤵
                                                                                                                          PID:1500
                                                                                                                        • C:\Windows\AppCompat\backup.exe
                                                                                                                          C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                                                          5⤵
                                                                                                                            PID:2072
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                                                      2⤵
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:612
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                                                      2⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:836
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                                                      2⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      • System policy modification
                                                                                                                      PID:1200
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                                                      2⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:548
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                                                      2⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Loads dropped DLL
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      • System policy modification
                                                                                                                      PID:1468
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                                                      2⤵
                                                                                                                      • Modifies visibility of file extensions in Explorer
                                                                                                                      • Disables RegEdit via registry modification
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                      PID:440

                                                                                                                  Network

                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                  Replay Monitor

                                                                                                                  Loading Replay Monitor...

                                                                                                                  Downloads

                                                                                                                  • C:\PerfLogs\Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    04f3b7b31cc142da15d3c404420c9273

                                                                                                                    SHA1

                                                                                                                    16f62cddbc14a4bdc2c30f281231f12155f5d111

                                                                                                                    SHA256

                                                                                                                    88f07427774c6221467455b0e106af20789eb2d47a2038e8c975070cecf51bf2

                                                                                                                    SHA512

                                                                                                                    c8753b3709900a50964ed10df2acd855830faad667a9d11d37a0dfcf99fea2292fd4e639914a155be22e6ca4a50d52ae638c3aec7df289ece3a8c1998cb5b888

                                                                                                                  • C:\PerfLogs\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    8cbf8832d7a2092a57b24aae3fab71e6

                                                                                                                    SHA1

                                                                                                                    c40f9abf7baa72282cba6db4400b24578ece0d13

                                                                                                                    SHA256

                                                                                                                    e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8

                                                                                                                    SHA512

                                                                                                                    f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54

                                                                                                                  • C:\PerfLogs\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    8cbf8832d7a2092a57b24aae3fab71e6

                                                                                                                    SHA1

                                                                                                                    c40f9abf7baa72282cba6db4400b24578ece0d13

                                                                                                                    SHA256

                                                                                                                    e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8

                                                                                                                    SHA512

                                                                                                                    f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54

                                                                                                                  • C:\Program Files\7-Zip\Lang\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • C:\Program Files\7-Zip\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • C:\Program Files\7-Zip\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    3da98d246240f88eaa64aae85346f07e

                                                                                                                    SHA1

                                                                                                                    eda2c6e84500fbff08b8121a2338af86ee71df31

                                                                                                                    SHA256

                                                                                                                    710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7

                                                                                                                    SHA512

                                                                                                                    53d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2

                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • C:\Program Files\Common Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • C:\Program Files\Common Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • C:\Program Files\data.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    e254fb54f8b29789b0deb8d7339fca79

                                                                                                                    SHA1

                                                                                                                    7900422743ef472adb0f870056744c0ec746f21e

                                                                                                                    SHA256

                                                                                                                    8a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c

                                                                                                                    SHA512

                                                                                                                    2c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8

                                                                                                                  • C:\Program Files\data.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    e254fb54f8b29789b0deb8d7339fca79

                                                                                                                    SHA1

                                                                                                                    7900422743ef472adb0f870056744c0ec746f21e

                                                                                                                    SHA256

                                                                                                                    8a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c

                                                                                                                    SHA512

                                                                                                                    2c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1652623185\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\1652623185\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • C:\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    6101a3014d817bd2c7278eccacfd4f02

                                                                                                                    SHA1

                                                                                                                    bce4155f7adb7cb999e50526eb69491a5133c41e

                                                                                                                    SHA256

                                                                                                                    c8a7422e963e69e18ca2fa47a2d2814da341b8a4e92ffbea8f108e6adec853f7

                                                                                                                    SHA512

                                                                                                                    1900f5c235ff7b06b45a1c00c431971d6333c3baaffd8151933bd93f28d24b1c2faae6223e359942715a13dfff08af10125fc8796db744e037ccfb4dc25aa404

                                                                                                                  • C:\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    6101a3014d817bd2c7278eccacfd4f02

                                                                                                                    SHA1

                                                                                                                    bce4155f7adb7cb999e50526eb69491a5133c41e

                                                                                                                    SHA256

                                                                                                                    c8a7422e963e69e18ca2fa47a2d2814da341b8a4e92ffbea8f108e6adec853f7

                                                                                                                    SHA512

                                                                                                                    1900f5c235ff7b06b45a1c00c431971d6333c3baaffd8151933bd93f28d24b1c2faae6223e359942715a13dfff08af10125fc8796db744e037ccfb4dc25aa404

                                                                                                                  • \PerfLogs\Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    04f3b7b31cc142da15d3c404420c9273

                                                                                                                    SHA1

                                                                                                                    16f62cddbc14a4bdc2c30f281231f12155f5d111

                                                                                                                    SHA256

                                                                                                                    88f07427774c6221467455b0e106af20789eb2d47a2038e8c975070cecf51bf2

                                                                                                                    SHA512

                                                                                                                    c8753b3709900a50964ed10df2acd855830faad667a9d11d37a0dfcf99fea2292fd4e639914a155be22e6ca4a50d52ae638c3aec7df289ece3a8c1998cb5b888

                                                                                                                  • \PerfLogs\Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    04f3b7b31cc142da15d3c404420c9273

                                                                                                                    SHA1

                                                                                                                    16f62cddbc14a4bdc2c30f281231f12155f5d111

                                                                                                                    SHA256

                                                                                                                    88f07427774c6221467455b0e106af20789eb2d47a2038e8c975070cecf51bf2

                                                                                                                    SHA512

                                                                                                                    c8753b3709900a50964ed10df2acd855830faad667a9d11d37a0dfcf99fea2292fd4e639914a155be22e6ca4a50d52ae638c3aec7df289ece3a8c1998cb5b888

                                                                                                                  • \PerfLogs\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    8cbf8832d7a2092a57b24aae3fab71e6

                                                                                                                    SHA1

                                                                                                                    c40f9abf7baa72282cba6db4400b24578ece0d13

                                                                                                                    SHA256

                                                                                                                    e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8

                                                                                                                    SHA512

                                                                                                                    f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54

                                                                                                                  • \PerfLogs\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    8cbf8832d7a2092a57b24aae3fab71e6

                                                                                                                    SHA1

                                                                                                                    c40f9abf7baa72282cba6db4400b24578ece0d13

                                                                                                                    SHA256

                                                                                                                    e39be1e3a5fe9678de52a07c40a4c33fdafc454977da940cec54ac4281adc9d8

                                                                                                                    SHA512

                                                                                                                    f30262432fa3a177370b6588b4d118de7b04fc3eddcd56cd6d0ed6266accb10307a3ca55486c140cd47171c159c8e0bdfee701a360c0fb125bad4e6e30f06d54

                                                                                                                  • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • \Program Files\7-Zip\Lang\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • \Program Files\7-Zip\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • \Program Files\7-Zip\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    58415da1e9bc15926282176bcf03a635

                                                                                                                    SHA1

                                                                                                                    0cff7f45af099f24ede9de788d7db33f4c0f4ee3

                                                                                                                    SHA256

                                                                                                                    53e13a09833971160344a77c536d9ee2c8be104ad64a2670c6301d9a0cdda14c

                                                                                                                    SHA512

                                                                                                                    6f1f12976c424659139233ab25625fdeda211296384a4158ceef402af3f51d5c07687f30a8976e7846ec3609b1a5733b463858ad891c9419fdd1e1094322fa32

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    3da98d246240f88eaa64aae85346f07e

                                                                                                                    SHA1

                                                                                                                    eda2c6e84500fbff08b8121a2338af86ee71df31

                                                                                                                    SHA256

                                                                                                                    710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7

                                                                                                                    SHA512

                                                                                                                    53d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    3da98d246240f88eaa64aae85346f07e

                                                                                                                    SHA1

                                                                                                                    eda2c6e84500fbff08b8121a2338af86ee71df31

                                                                                                                    SHA256

                                                                                                                    710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7

                                                                                                                    SHA512

                                                                                                                    53d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    eb18045a9becfa2a8219c51ba66cf9f8

                                                                                                                    SHA1

                                                                                                                    b98970c869ffd903114580ca9dd4cc4483ce7225

                                                                                                                    SHA256

                                                                                                                    6d737fa9eb62375e7c4cad2f679d2ac170f602ac523fef98d4ac4bc5bf704310

                                                                                                                    SHA512

                                                                                                                    9e5b04aeed6ce06c189e397402949b247e43633c985eff845e60647821bdfbc8a884a182a961928fb0cfdd5e895b7466666c8a72803eed65c410af183af2aadb

                                                                                                                  • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    3da98d246240f88eaa64aae85346f07e

                                                                                                                    SHA1

                                                                                                                    eda2c6e84500fbff08b8121a2338af86ee71df31

                                                                                                                    SHA256

                                                                                                                    710f676c2b139f94e49b755b0a8a94994eebb02eb05085ac51458f6bd2629cf7

                                                                                                                    SHA512

                                                                                                                    53d951efb198c7cc0bfcf42dc0c736e383cead09d38a0e6ca205964282670d337fc776a78bb69baf5c5fab3f4179fe83b5e552f4f6d2c645d1a3621d20b987c2

                                                                                                                  • \Program Files\Common Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • \Program Files\Common Files\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    bc2db97578217c5d242af3b1ca19e6c0

                                                                                                                    SHA1

                                                                                                                    68daf8714371dbb191eb0fb0c7d1405b154501a1

                                                                                                                    SHA256

                                                                                                                    8bd310c77c1cdff86bf8c65cb55418a249f222bd1820dda1760da0af7aa387d9

                                                                                                                    SHA512

                                                                                                                    a21138dffd0dc61e0414daa39a470f186a8172cc8eabb0f10d40e9082af8fab72ca241f8b7f455af2510b65d20ae185b05651e2a022f827e6b419d0039124a34

                                                                                                                  • \Program Files\data.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    e254fb54f8b29789b0deb8d7339fca79

                                                                                                                    SHA1

                                                                                                                    7900422743ef472adb0f870056744c0ec746f21e

                                                                                                                    SHA256

                                                                                                                    8a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c

                                                                                                                    SHA512

                                                                                                                    2c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8

                                                                                                                  • \Program Files\data.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    e254fb54f8b29789b0deb8d7339fca79

                                                                                                                    SHA1

                                                                                                                    7900422743ef472adb0f870056744c0ec746f21e

                                                                                                                    SHA256

                                                                                                                    8a2b354b8d47af47e739fa26474d95bdb370588d6dbe0843e339866e34c7893c

                                                                                                                    SHA512

                                                                                                                    2c263cfcaf1212490fe5cf56efcf8a254d650deb4f21bd152944a6874775d89109b84cecdab6d7cfe0113a3cb9b5b115bed4f5ce20847abc848c230b2d8dece8

                                                                                                                  • \Users\Admin\AppData\Local\Temp\1652623185\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • \Users\Admin\AppData\Local\Temp\1652623185\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    9c2afbb71c0216fde34b4c671252e6a8

                                                                                                                    SHA1

                                                                                                                    38472515c7f83317737f4a9cadbf9fcd02d2e6f6

                                                                                                                    SHA256

                                                                                                                    ba9717d0a24a9d241bfb140e0d4f6ead360fa11003f5720fc9e950413ccf463f

                                                                                                                    SHA512

                                                                                                                    6e2b34e10c70bff8743c226980af4afca7eedbc9a842962c02872e29b0c91befa8685c03b227d6a62a4346b883624187ee9d66aff0118528c7679b528793b349

                                                                                                                  • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe

                                                                                                                    Filesize

                                                                                                                    72KB

                                                                                                                    MD5

                                                                                                                    5ea8c83f2d9c248e84fede3924b4d22e

                                                                                                                    SHA1

                                                                                                                    e429a6e9414319613ed1821b9fd1bcaf53058663

                                                                                                                    SHA256

                                                                                                                    8b626ab7b4a382ad9f1b0d2171efcc86ea3f384ff41361a113fb8257ee6c2c51

                                                                                                                    SHA512

                                                                                                                    29c620aac12330938859b827dfc87b9d55feb5fad1c81b20b91a4e6416bb001359c2140c3b77186e460491aed9bc354267dc886ca13eb4b4c0f3f60fc66dcc25

                                                                                                                  • memory/1468-90-0x00000000756B1000-0x00000000756B3000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB

                                                                                                                  • memory/1968-119-0x0000000074C31000-0x0000000074C33000-memory.dmp

                                                                                                                    Filesize

                                                                                                                    8KB