Analysis

  • max time kernel
    190s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:10 UTC

General

  • Target

    65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe

  • Size

    72KB

  • MD5

    0a1fa8f639125448774cb1ba2cfdf870

  • SHA1

    921f41a6155c36564b581e640d8aac8dcbd6e8ba

  • SHA256

    65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8

  • SHA512

    0baec6df52c5498b6f4645e9f837c4a9460425594ae0a8a5e79bb45a188f4225056d8d4795aeb7aecd4c781988f9a662a7eac84dc0f90f283454e98f9e432f5d

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2v:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrj

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 47 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 63 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 63 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe
    "C:\Users\Admin\AppData\Local\Temp\65708fa4b83bbdd70ecd7dc274efc98179a63025a248c40304a4c9e38fd94fa8.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:616
    • C:\Users\Admin\AppData\Local\Temp\4110414595\backup.exe
      C:\Users\Admin\AppData\Local\Temp\4110414595\backup.exe C:\Users\Admin\AppData\Local\Temp\4110414595\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:832
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:324
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1952
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:316
        • C:\Program Files\update.exe
          "C:\Program Files\update.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1176
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1888
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1624
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:2032
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:1156
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:432
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:536
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1612
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1940
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:520
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1328
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:916
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:308
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1044
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:752
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1960
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1720
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:480
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:316
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1068
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1508
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1168
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:992
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1672
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1888
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:268
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:520
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:688
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1396
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:604
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:480
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1576
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Suspicious use of SetWindowsHookEx
                  PID:432
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                    PID:1052
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1772
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1496
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                    8⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1780
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                    8⤵
                    • Executes dropped EXE
                    PID:1988
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                    8⤵
                      PID:1528
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                      8⤵
                        PID:660
                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                      7⤵
                      • Executes dropped EXE
                      PID:564
                    • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:736
                    • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                      7⤵
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1372
                    • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                      7⤵
                      • Executes dropped EXE
                      PID:1552
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                      7⤵
                        PID:1512
                      • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                        7⤵
                          PID:452
                      • C:\Program Files\Common Files\Services\backup.exe
                        "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                        6⤵
                        • Modifies visibility of file extensions in Explorer
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1816
                      • C:\Program Files\Common Files\SpeechEngines\backup.exe
                        "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                        6⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1964
                        • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                          "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                          7⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1348
                      • C:\Program Files\Common Files\System\backup.exe
                        "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                        6⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1660
                        • C:\Program Files\Common Files\System\ado\backup.exe
                          "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                          7⤵
                            PID:1604
                      • C:\Program Files\DVD Maker\backup.exe
                        "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                        5⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1776
                        • C:\Program Files\DVD Maker\de-DE\backup.exe
                          "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                          6⤵
                            PID:568
                        • C:\Program Files\Google\backup.exe
                          "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1524
                        • C:\Program Files\Internet Explorer\backup.exe
                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1884
                        • C:\Program Files\Java\backup.exe
                          "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                          5⤵
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          PID:1764
                        • C:\Program Files\Microsoft Games\System Restore.exe
                          "C:\Program Files\Microsoft Games\System Restore.exe" C:\Program Files\Microsoft Games\
                          5⤵
                          • Executes dropped EXE
                          PID:600
                        • C:\Program Files\Microsoft Office\backup.exe
                          "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                          5⤵
                          • Suspicious use of SetWindowsHookEx
                          PID:1448
                        • C:\Program Files\Mozilla Firefox\backup.exe
                          "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
                          5⤵
                            PID:2040
                        • C:\Program Files (x86)\backup.exe
                          "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                          4⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:1648
                          • C:\Program Files (x86)\Adobe\backup.exe
                            "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                            5⤵
                              PID:1516
                            • C:\Program Files (x86)\Common Files\backup.exe
                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                              5⤵
                                PID:828
                            • C:\Users\backup.exe
                              C:\Users\backup.exe C:\Users\
                              4⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1164
                              • C:\Users\Admin\backup.exe
                                C:\Users\Admin\backup.exe C:\Users\Admin\
                                5⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1252
                              • C:\Users\Public\backup.exe
                                C:\Users\Public\backup.exe C:\Users\Public\
                                5⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1104
                                • C:\Users\Public\Documents\backup.exe
                                  C:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\
                                  6⤵
                                    PID:1632
                              • C:\Windows\backup.exe
                                C:\Windows\backup.exe C:\Windows\
                                4⤵
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:968
                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                            2⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1764
                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:756
                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                            2⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1688
                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                            2⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:392
                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                            2⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1116
                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                            C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                            2⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1884

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\PerfLogs\Admin\backup.exe

                          Filesize

                          72KB

                          MD5

                          132f53bcc0a6cc6249fdb3c3c25c29a7

                          SHA1

                          9db84edbf0faeb547c01732ebe7fd80396718573

                          SHA256

                          64436a72cb63d699a180756ebec4112a1e283be71d2ca9c0d36618df6e643697

                          SHA512

                          1e260d09e12f30a2a2b41b4c3e333dd24934dc1d456c2d10deefacf9a139a57b3edacc6e918a49bec8bac4bd8c1505ca5accc9fba4a961fa850e056a912f66a2

                        • C:\PerfLogs\backup.exe

                          Filesize

                          72KB

                          MD5

                          b0ffe5060dffd79377743e0fe4a710ce

                          SHA1

                          212e72eebea1d4fb96cc9594444a268b33245a2d

                          SHA256

                          72be619294cabb8fa00de044afb9de54099f8fb072333b8847cb34424f4b262a

                          SHA512

                          e8532443c51445a1182e0e2eadf1202194066c8cf4f499e4c439a89768c80f98b5455ad8cfd15356023c90d356f171931ccc9c280a537d4e09509de7c228b23d

                        • C:\PerfLogs\backup.exe

                          Filesize

                          72KB

                          MD5

                          b0ffe5060dffd79377743e0fe4a710ce

                          SHA1

                          212e72eebea1d4fb96cc9594444a268b33245a2d

                          SHA256

                          72be619294cabb8fa00de044afb9de54099f8fb072333b8847cb34424f4b262a

                          SHA512

                          e8532443c51445a1182e0e2eadf1202194066c8cf4f499e4c439a89768c80f98b5455ad8cfd15356023c90d356f171931ccc9c280a537d4e09509de7c228b23d

                        • C:\Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • C:\Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • C:\Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • C:\Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • C:\Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • C:\Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • C:\Program Files\update.exe

                          Filesize

                          72KB

                          MD5

                          5a66be44a5a7a00a0c15253d67030699

                          SHA1

                          965bd987fdc0b8d81b56e7f9f86ea7a7298b3e23

                          SHA256

                          7b15fb33033ce04a0e2e231dcf53f84e4d1fe51dcfd5e064410ff97eb00935cd

                          SHA512

                          9a2a9fc451aed9607c3e8b40126ea3f5d8479cab9fcc2234a614c741234a5d7f08ea0e5d0aeeee2e82f0d7deadfb44c1ec0a8dd4585fbf4c05387b65cdfe257c

                        • C:\Program Files\update.exe

                          Filesize

                          72KB

                          MD5

                          5a66be44a5a7a00a0c15253d67030699

                          SHA1

                          965bd987fdc0b8d81b56e7f9f86ea7a7298b3e23

                          SHA256

                          7b15fb33033ce04a0e2e231dcf53f84e4d1fe51dcfd5e064410ff97eb00935cd

                          SHA512

                          9a2a9fc451aed9607c3e8b40126ea3f5d8479cab9fcc2234a614c741234a5d7f08ea0e5d0aeeee2e82f0d7deadfb44c1ec0a8dd4585fbf4c05387b65cdfe257c

                        • C:\Users\Admin\AppData\Local\Temp\4110414595\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • C:\Users\Admin\AppData\Local\Temp\4110414595\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                          Filesize

                          72KB

                          MD5

                          694c848591f1bc6861bf5d61ba238a7a

                          SHA1

                          5f86cd953bd5839c55b691c48e2f4776568aa01e

                          SHA256

                          202681cf0210325a94cd9e54f25b0f6c95c23f24c608585d81a78fef06ae7c39

                          SHA512

                          d529258668c48aeb0144c91458c86d70e4894a7f77d46757829cdec6583b6fb6b3345ce9066562ea042a2114957a99da9ce2bdcdaea311066128d104cdb291e2

                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                          Filesize

                          72KB

                          MD5

                          694c848591f1bc6861bf5d61ba238a7a

                          SHA1

                          5f86cd953bd5839c55b691c48e2f4776568aa01e

                          SHA256

                          202681cf0210325a94cd9e54f25b0f6c95c23f24c608585d81a78fef06ae7c39

                          SHA512

                          d529258668c48aeb0144c91458c86d70e4894a7f77d46757829cdec6583b6fb6b3345ce9066562ea042a2114957a99da9ce2bdcdaea311066128d104cdb291e2

                        • C:\backup.exe

                          Filesize

                          72KB

                          MD5

                          9653b7703e40e27b9618ebf2b7190aed

                          SHA1

                          765da1c293d7181f4781d2e3b36a964a9f28f08c

                          SHA256

                          f638a0251e1140995c478d911116fb0af1a15873ac26b0a0774074c5fc349556

                          SHA512

                          ca992a0b059f393a0d874a9d5a560dd0e4c1e6b443f90ae834f70dde6b679571a7e3c5b5bfa6abd4e0bdf9abf919a5864e0c69c798274d8a191a5e4c1a4983b4

                        • C:\backup.exe

                          Filesize

                          72KB

                          MD5

                          9653b7703e40e27b9618ebf2b7190aed

                          SHA1

                          765da1c293d7181f4781d2e3b36a964a9f28f08c

                          SHA256

                          f638a0251e1140995c478d911116fb0af1a15873ac26b0a0774074c5fc349556

                          SHA512

                          ca992a0b059f393a0d874a9d5a560dd0e4c1e6b443f90ae834f70dde6b679571a7e3c5b5bfa6abd4e0bdf9abf919a5864e0c69c798274d8a191a5e4c1a4983b4

                        • \PerfLogs\Admin\backup.exe

                          Filesize

                          72KB

                          MD5

                          132f53bcc0a6cc6249fdb3c3c25c29a7

                          SHA1

                          9db84edbf0faeb547c01732ebe7fd80396718573

                          SHA256

                          64436a72cb63d699a180756ebec4112a1e283be71d2ca9c0d36618df6e643697

                          SHA512

                          1e260d09e12f30a2a2b41b4c3e333dd24934dc1d456c2d10deefacf9a139a57b3edacc6e918a49bec8bac4bd8c1505ca5accc9fba4a961fa850e056a912f66a2

                        • \PerfLogs\Admin\backup.exe

                          Filesize

                          72KB

                          MD5

                          132f53bcc0a6cc6249fdb3c3c25c29a7

                          SHA1

                          9db84edbf0faeb547c01732ebe7fd80396718573

                          SHA256

                          64436a72cb63d699a180756ebec4112a1e283be71d2ca9c0d36618df6e643697

                          SHA512

                          1e260d09e12f30a2a2b41b4c3e333dd24934dc1d456c2d10deefacf9a139a57b3edacc6e918a49bec8bac4bd8c1505ca5accc9fba4a961fa850e056a912f66a2

                        • \PerfLogs\backup.exe

                          Filesize

                          72KB

                          MD5

                          b0ffe5060dffd79377743e0fe4a710ce

                          SHA1

                          212e72eebea1d4fb96cc9594444a268b33245a2d

                          SHA256

                          72be619294cabb8fa00de044afb9de54099f8fb072333b8847cb34424f4b262a

                          SHA512

                          e8532443c51445a1182e0e2eadf1202194066c8cf4f499e4c439a89768c80f98b5455ad8cfd15356023c90d356f171931ccc9c280a537d4e09509de7c228b23d

                        • \PerfLogs\backup.exe

                          Filesize

                          72KB

                          MD5

                          b0ffe5060dffd79377743e0fe4a710ce

                          SHA1

                          212e72eebea1d4fb96cc9594444a268b33245a2d

                          SHA256

                          72be619294cabb8fa00de044afb9de54099f8fb072333b8847cb34424f4b262a

                          SHA512

                          e8532443c51445a1182e0e2eadf1202194066c8cf4f499e4c439a89768c80f98b5455ad8cfd15356023c90d356f171931ccc9c280a537d4e09509de7c228b23d

                        • \Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\7-Zip\Lang\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\7-Zip\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                          Filesize

                          72KB

                          MD5

                          cbc7a7665950da42de6597ce7c95fcd2

                          SHA1

                          dd99dbb4035f8f743691387a26feda3dba2d0fc0

                          SHA256

                          d2e2ae0ad8c1fc900f026b00b159200e9e1f4d66cfa2e4216a977e2d8946dcd8

                          SHA512

                          0165e982f1c58d26ca3308cf876b73397572ba8f376b49998e9ac313ee8f9b8bf70cabdc85f1ccdb192fdddb054d1f83bcd87781454c7d938db2b9a1d8242c82

                        • \Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\Common Files\backup.exe

                          Filesize

                          72KB

                          MD5

                          f404425791fd5d1c75a0cd124ee7731c

                          SHA1

                          187cf3d3a21398cf789e5a9f49927800de1086df

                          SHA256

                          e9ed38afb27815fb33b9ce3d3431ded00263ca828b09521785eca2bb479797c9

                          SHA512

                          874a1eeb2fc60fabc196e75d00622815652b7e7ef813ebb9506fbc10eeab3dc5b694277f359ccabc14b6affc9e3f109ef7ba7e08f7a529d566d7e2dfd84f0e51

                        • \Program Files\update.exe

                          Filesize

                          72KB

                          MD5

                          5a66be44a5a7a00a0c15253d67030699

                          SHA1

                          965bd987fdc0b8d81b56e7f9f86ea7a7298b3e23

                          SHA256

                          7b15fb33033ce04a0e2e231dcf53f84e4d1fe51dcfd5e064410ff97eb00935cd

                          SHA512

                          9a2a9fc451aed9607c3e8b40126ea3f5d8479cab9fcc2234a614c741234a5d7f08ea0e5d0aeeee2e82f0d7deadfb44c1ec0a8dd4585fbf4c05387b65cdfe257c

                        • \Program Files\update.exe

                          Filesize

                          72KB

                          MD5

                          5a66be44a5a7a00a0c15253d67030699

                          SHA1

                          965bd987fdc0b8d81b56e7f9f86ea7a7298b3e23

                          SHA256

                          7b15fb33033ce04a0e2e231dcf53f84e4d1fe51dcfd5e064410ff97eb00935cd

                          SHA512

                          9a2a9fc451aed9607c3e8b40126ea3f5d8479cab9fcc2234a614c741234a5d7f08ea0e5d0aeeee2e82f0d7deadfb44c1ec0a8dd4585fbf4c05387b65cdfe257c

                        • \Program Files\update.exe

                          Filesize

                          72KB

                          MD5

                          5a66be44a5a7a00a0c15253d67030699

                          SHA1

                          965bd987fdc0b8d81b56e7f9f86ea7a7298b3e23

                          SHA256

                          7b15fb33033ce04a0e2e231dcf53f84e4d1fe51dcfd5e064410ff97eb00935cd

                          SHA512

                          9a2a9fc451aed9607c3e8b40126ea3f5d8479cab9fcc2234a614c741234a5d7f08ea0e5d0aeeee2e82f0d7deadfb44c1ec0a8dd4585fbf4c05387b65cdfe257c

                        • \Program Files\update.exe

                          Filesize

                          72KB

                          MD5

                          5a66be44a5a7a00a0c15253d67030699

                          SHA1

                          965bd987fdc0b8d81b56e7f9f86ea7a7298b3e23

                          SHA256

                          7b15fb33033ce04a0e2e231dcf53f84e4d1fe51dcfd5e064410ff97eb00935cd

                          SHA512

                          9a2a9fc451aed9607c3e8b40126ea3f5d8479cab9fcc2234a614c741234a5d7f08ea0e5d0aeeee2e82f0d7deadfb44c1ec0a8dd4585fbf4c05387b65cdfe257c

                        • \Users\Admin\AppData\Local\Temp\4110414595\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\4110414595\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                          Filesize

                          72KB

                          MD5

                          694c848591f1bc6861bf5d61ba238a7a

                          SHA1

                          5f86cd953bd5839c55b691c48e2f4776568aa01e

                          SHA256

                          202681cf0210325a94cd9e54f25b0f6c95c23f24c608585d81a78fef06ae7c39

                          SHA512

                          d529258668c48aeb0144c91458c86d70e4894a7f77d46757829cdec6583b6fb6b3345ce9066562ea042a2114957a99da9ce2bdcdaea311066128d104cdb291e2

                        • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                          Filesize

                          72KB

                          MD5

                          694c848591f1bc6861bf5d61ba238a7a

                          SHA1

                          5f86cd953bd5839c55b691c48e2f4776568aa01e

                          SHA256

                          202681cf0210325a94cd9e54f25b0f6c95c23f24c608585d81a78fef06ae7c39

                          SHA512

                          d529258668c48aeb0144c91458c86d70e4894a7f77d46757829cdec6583b6fb6b3345ce9066562ea042a2114957a99da9ce2bdcdaea311066128d104cdb291e2

                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                          Filesize

                          72KB

                          MD5

                          c6031882b96cd28127a25686d21fdd05

                          SHA1

                          c2886acbe04f468e9f2f7cedf6fc4fdc69df631f

                          SHA256

                          cc56c179e4156a9ba096697dfeb94b75f08630a56707eed6c516481c401d52b4

                          SHA512

                          7510d51209d3ccfc07e7bb46d414c8259c2ba91f4271f4ec5720347926f18bc19fb2a6caa8e54f6cae95d41958df1adfcd51087a9ec7c2ef535a19266034ab6c

                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                          Filesize

                          72KB

                          MD5

                          694c848591f1bc6861bf5d61ba238a7a

                          SHA1

                          5f86cd953bd5839c55b691c48e2f4776568aa01e

                          SHA256

                          202681cf0210325a94cd9e54f25b0f6c95c23f24c608585d81a78fef06ae7c39

                          SHA512

                          d529258668c48aeb0144c91458c86d70e4894a7f77d46757829cdec6583b6fb6b3345ce9066562ea042a2114957a99da9ce2bdcdaea311066128d104cdb291e2

                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                          Filesize

                          72KB

                          MD5

                          694c848591f1bc6861bf5d61ba238a7a

                          SHA1

                          5f86cd953bd5839c55b691c48e2f4776568aa01e

                          SHA256

                          202681cf0210325a94cd9e54f25b0f6c95c23f24c608585d81a78fef06ae7c39

                          SHA512

                          d529258668c48aeb0144c91458c86d70e4894a7f77d46757829cdec6583b6fb6b3345ce9066562ea042a2114957a99da9ce2bdcdaea311066128d104cdb291e2

                        • memory/616-102-0x00000000746D1000-0x00000000746D3000-memory.dmp

                          Filesize

                          8KB

                        • memory/616-98-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

                          Filesize

                          8KB

                        We care about your privacy.

                        This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.