Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    151s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 14:16

General

  • Target

    4a8e09cda9f72ca91f9a78a10ff873f1f020b174691a44189410934504d00c11.exe

  • Size

    72KB

  • MD5

    0108d7ba428c61fd515117764350a13b

  • SHA1

    b3020ddf0848ec9878b19b6582970a3b80f16d3c

  • SHA256

    4a8e09cda9f72ca91f9a78a10ff873f1f020b174691a44189410934504d00c11

  • SHA512

    d08a63fb4fdd3fc27a9872ae345ef8ee23f5ca433c6b1c151c947df5238a024286611d7da18c9e574cc18c85255a525484910e05c53e5484255fc59b5ffb104c

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2h:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPV

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a8e09cda9f72ca91f9a78a10ff873f1f020b174691a44189410934504d00c11.exe
    "C:\Users\Admin\AppData\Local\Temp\4a8e09cda9f72ca91f9a78a10ff873f1f020b174691a44189410934504d00c11.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:564
    • C:\Users\Admin\AppData\Local\Temp\4114709684\backup.exe
      C:\Users\Admin\AppData\Local\Temp\4114709684\backup.exe C:\Users\Admin\AppData\Local\Temp\4114709684\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1928
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1288
        • C:\PerfLogs\System Restore.exe
          "C:\PerfLogs\System Restore.exe" C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1116
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1732
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1496
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1600
            • C:\Program Files\7-Zip\Lang\System Restore.exe
              "C:\Program Files\7-Zip\Lang\System Restore.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1944
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1360
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1692
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:472
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:584
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1680
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:792
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1616
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1164
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1316
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1168
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1392
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:956
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1756
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1712
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1728
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2000
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1352
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:592
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:288
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1696
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1996
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1788
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:848
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:956
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Executes dropped EXE
                    PID:552
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:424
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1804
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1636
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1940
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1756
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:316
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1580
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:1876
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  PID:1712
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1012
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                    PID:368
                  • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                    8⤵
                      PID:956
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    PID:1128
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1876
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:1620
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:960
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      PID:548
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      PID:1696
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                      8⤵
                        PID:2016
                    • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Drops file in Program Files directory
                      • System policy modification
                      PID:596
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                        8⤵
                          PID:1936
                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                          PID:1136
                        • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                          7⤵
                            PID:1484
                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                            7⤵
                              PID:1696
                          • C:\Program Files\Common Files\Services\backup.exe
                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1764
                          • C:\Program Files\Common Files\SpeechEngines\backup.exe
                            "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:828
                            • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                              "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1328
                          • C:\Program Files\Common Files\System\backup.exe
                            "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            PID:1232
                            • C:\Program Files\Common Files\System\ado\update.exe
                              "C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Executes dropped EXE
                              • Drops file in Program Files directory
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1352
                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                8⤵
                                • Modifies visibility of file extensions in Explorer
                                • Executes dropped EXE
                                • Suspicious use of SetWindowsHookEx
                                PID:1372
                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                8⤵
                                  PID:472
                                • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                  "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                  8⤵
                                    PID:1556
                                  • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                    "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                    8⤵
                                      PID:1548
                                    • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                      "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                      8⤵
                                        PID:1304
                                    • C:\Program Files\Common Files\System\de-DE\backup.exe
                                      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                      7⤵
                                        PID:600
                                      • C:\Program Files\Common Files\System\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                        7⤵
                                          PID:1488
                                        • C:\Program Files\Common Files\System\es-ES\backup.exe
                                          "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
                                          7⤵
                                            PID:2020
                                          • C:\Program Files\Common Files\System\fr-FR\backup.exe
                                            "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
                                            7⤵
                                              PID:1680
                                        • C:\Program Files\DVD Maker\backup.exe
                                          "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:568
                                          • C:\Program Files\DVD Maker\de-DE\backup.exe
                                            "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1936
                                          • C:\Program Files\DVD Maker\en-US\backup.exe
                                            "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1340
                                          • C:\Program Files\DVD Maker\es-ES\backup.exe
                                            "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                            6⤵
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1824
                                          • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                            "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1012
                                          • C:\Program Files\DVD Maker\it-IT\backup.exe
                                            "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            PID:1484
                                          • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                            "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:2008
                                          • C:\Program Files\DVD Maker\Shared\backup.exe
                                            "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Drops file in Program Files directory
                                            • System policy modification
                                            PID:640
                                            • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                              "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                              7⤵
                                                PID:1616
                                          • C:\Program Files\Google\backup.exe
                                            "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                            5⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            PID:424
                                          • C:\Program Files\Internet Explorer\backup.exe
                                            "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                            5⤵
                                              PID:1340
                                            • C:\Program Files\Java\backup.exe
                                              "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                              5⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              • Drops file in Program Files directory
                                              • System policy modification
                                              PID:1816
                                              • C:\Program Files\Java\jdk1.7.0_80\System Restore.exe
                                                "C:\Program Files\Java\jdk1.7.0_80\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                6⤵
                                                  PID:1820
                                                • C:\Program Files\Java\jre7\backup.exe
                                                  "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
                                                  6⤵
                                                    PID:1512
                                                • C:\Program Files\Microsoft Games\update.exe
                                                  "C:\Program Files\Microsoft Games\update.exe" C:\Program Files\Microsoft Games\
                                                  5⤵
                                                    PID:316
                                                  • C:\Program Files\Microsoft Office\update.exe
                                                    "C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\
                                                    5⤵
                                                      PID:1744
                                                  • C:\Program Files (x86)\backup.exe
                                                    "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                    4⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1688
                                                    • C:\Program Files (x86)\Adobe\update.exe
                                                      "C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\
                                                      5⤵
                                                      • Executes dropped EXE
                                                      • Suspicious use of SetWindowsHookEx
                                                      PID:780
                                                    • C:\Program Files (x86)\Common Files\backup.exe
                                                      "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                      5⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Drops file in Program Files directory
                                                      PID:1868
                                                      • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                        "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                        6⤵
                                                        • Modifies visibility of file extensions in Explorer
                                                        • Drops file in Program Files directory
                                                        • System policy modification
                                                        PID:632
                                                        • C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
                                                          "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
                                                          7⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Drops file in Program Files directory
                                                          PID:1476
                                                        • C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
                                                          "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
                                                          7⤵
                                                            PID:936
                                                          • C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
                                                            "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
                                                            7⤵
                                                              PID:860
                                                          • C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe
                                                            "C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
                                                            6⤵
                                                              PID:1732
                                                            • C:\Program Files (x86)\Common Files\DESIGNER\backup.exe
                                                              "C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\
                                                              6⤵
                                                                PID:1812
                                                              • C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
                                                                "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
                                                                6⤵
                                                                  PID:1164
                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                5⤵
                                                                • System policy modification
                                                                PID:848
                                                                • C:\Program Files (x86)\Google\CrashReports\backup.exe
                                                                  "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
                                                                  6⤵
                                                                    PID:1100
                                                                  • C:\Program Files (x86)\Google\Policies\backup.exe
                                                                    "C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\
                                                                    6⤵
                                                                      PID:1580
                                                                  • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                    "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                    5⤵
                                                                      PID:1956
                                                                    • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                      "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                      5⤵
                                                                        PID:976
                                                                      • C:\Program Files (x86)\Microsoft Office\backup.exe
                                                                        "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
                                                                        5⤵
                                                                          PID:1168
                                                                      • C:\Users\backup.exe
                                                                        C:\Users\backup.exe C:\Users\
                                                                        4⤵
                                                                          PID:1992
                                                                        • C:\Windows\backup.exe
                                                                          C:\Windows\backup.exe C:\Windows\
                                                                          4⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Drops file in Windows directory
                                                                          PID:968
                                                                          • C:\Windows\addins\backup.exe
                                                                            C:\Windows\addins\backup.exe C:\Windows\addins\
                                                                            5⤵
                                                                              PID:1756
                                                                            • C:\Windows\AppCompat\update.exe
                                                                              C:\Windows\AppCompat\update.exe C:\Windows\AppCompat\
                                                                              5⤵
                                                                              • Modifies visibility of file extensions in Explorer
                                                                              • Disables RegEdit via registry modification
                                                                              • System policy modification
                                                                              PID:548
                                                                            • C:\Windows\AppPatch\backup.exe
                                                                              C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                              5⤵
                                                                                PID:2032
                                                                              • C:\Windows\assembly\backup.exe
                                                                                C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                5⤵
                                                                                  PID:1704
                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                            2⤵
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1556
                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1284
                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1728
                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:288
                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:944
                                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:2028

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\PerfLogs\Admin\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7878c4da1e602e990e8e93074fdd238f

                                                                          SHA1

                                                                          e1bdd96974f3ba7f467de3016897a55134436b64

                                                                          SHA256

                                                                          46f7cc61cdd81654fcb216d8f2aff0da323da5a194b1e6e78dd9fa1ceab4d2d5

                                                                          SHA512

                                                                          1a4c1c8b6ebb5f3dbcab1cae7d13deb3b738892ef7009af7e2b975fc7a8c4eb7f428272fd5570291f21a1e8274a7713cb42b25c6124a5c11e327c543cd005a56

                                                                        • C:\PerfLogs\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e5dd69fbb93ad50d5571efb563d5f8ea

                                                                          SHA1

                                                                          9a4748afd20faa8f0179fd91e254a5ab8bdfa42b

                                                                          SHA256

                                                                          ae64e5694607f1e17faee4981531d45aa193b7d5497f468a3f6f5ab710fbad23

                                                                          SHA512

                                                                          0992eca91973a690099de2ca3835d19ba7f5aee1b46f4ea04821e82017e86f3957740d5f69a381b487d0b86a534c7057187b78bbc701b180d28e7fc1fcaaf0f3

                                                                        • C:\PerfLogs\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e5dd69fbb93ad50d5571efb563d5f8ea

                                                                          SHA1

                                                                          9a4748afd20faa8f0179fd91e254a5ab8bdfa42b

                                                                          SHA256

                                                                          ae64e5694607f1e17faee4981531d45aa193b7d5497f468a3f6f5ab710fbad23

                                                                          SHA512

                                                                          0992eca91973a690099de2ca3835d19ba7f5aee1b46f4ea04821e82017e86f3957740d5f69a381b487d0b86a534c7057187b78bbc701b180d28e7fc1fcaaf0f3

                                                                        • C:\Program Files\7-Zip\Lang\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          304cb4be9ea0f74d906610c9485f4efa

                                                                          SHA1

                                                                          9b38ef8788decbacbaaa931a45ef4bd53dd6ba24

                                                                          SHA256

                                                                          f291ddc0770c1f58056d4d3b1e1edd4a1716ec9aa790f53e210975ef66c02a7b

                                                                          SHA512

                                                                          e3f9d38973b61817e7a4eba0d0f846fb14f25f92625156a6ad6b60e0b324c03e42b180e12b5b49d400a6afdf645d70aafc8244dc6b6e837548bda8ad3d1138d9

                                                                        • C:\Program Files\7-Zip\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          215f8dec92a22bc2d638661d453feea0

                                                                          SHA1

                                                                          273af4f133c8ee137eb35611052023765cd7a209

                                                                          SHA256

                                                                          9314bc3ae516ae9de21ce1b1f39095fec056dc124978ed4079ae00b619f8856b

                                                                          SHA512

                                                                          1721baa3adb009fd3c30844bda208b4ddcd6c565a1d2409b9245e2d03d8964482b90856fd269077592e6ad0bf1a29eb5aeaccaf966e7ccaa65b57d2ce832929f

                                                                        • C:\Program Files\7-Zip\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          215f8dec92a22bc2d638661d453feea0

                                                                          SHA1

                                                                          273af4f133c8ee137eb35611052023765cd7a209

                                                                          SHA256

                                                                          9314bc3ae516ae9de21ce1b1f39095fec056dc124978ed4079ae00b619f8856b

                                                                          SHA512

                                                                          1721baa3adb009fd3c30844bda208b4ddcd6c565a1d2409b9245e2d03d8964482b90856fd269077592e6ad0bf1a29eb5aeaccaf966e7ccaa65b57d2ce832929f

                                                                        • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e1fe46192f1eb45af028f35385770329

                                                                          SHA1

                                                                          c0554c95191e53b8063629bad03c2c638c4db98c

                                                                          SHA256

                                                                          57c2aa6e995276fc34aaf43ac6f56436156e54e799601b9e433780b84dcfe1e9

                                                                          SHA512

                                                                          98d128cd909992103eab9ee596a7f7188538a08668145fb7549e6b277fea811e1d11f35c7c2e045f0148af1fbd72e6a9c3a744c1080db252520f389306e56444

                                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          9b6b5e584bff3e99bbc4e097e96e20a6

                                                                          SHA1

                                                                          b60b50b729738b225eee21f5df79321595ad3ee6

                                                                          SHA256

                                                                          46ce45bf97a3cb4aed344708aded80a0a8321a5cec853f3338b1f20fb7c6904d

                                                                          SHA512

                                                                          3cdcd22743de365ee06b7ef9c2fd8e911a85659a8dd5595e136e500da7d8f893005edef4f7892dfcf46716906f06cd82527e7a5a6cc02a9e8e6be50ae8275f28

                                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          9b6b5e584bff3e99bbc4e097e96e20a6

                                                                          SHA1

                                                                          b60b50b729738b225eee21f5df79321595ad3ee6

                                                                          SHA256

                                                                          46ce45bf97a3cb4aed344708aded80a0a8321a5cec853f3338b1f20fb7c6904d

                                                                          SHA512

                                                                          3cdcd22743de365ee06b7ef9c2fd8e911a85659a8dd5595e136e500da7d8f893005edef4f7892dfcf46716906f06cd82527e7a5a6cc02a9e8e6be50ae8275f28

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6e9bfe95e2722593de1393744ada5f90

                                                                          SHA1

                                                                          71a3f28417e56594f527049e77dc7f96cfe722d0

                                                                          SHA256

                                                                          39573aff5c97b720ecf44ff1d2a2c493f5f071fd662021a5aad9bcc19fd1a0ae

                                                                          SHA512

                                                                          786816ea352d0e8a062787ac27c989f12d7d884b6f8055012d7d2768399a952f46b1fae01cee748fb21264011eac0c8dcb1e1ab06321f7c0e6b88346aec35854

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6e9bfe95e2722593de1393744ada5f90

                                                                          SHA1

                                                                          71a3f28417e56594f527049e77dc7f96cfe722d0

                                                                          SHA256

                                                                          39573aff5c97b720ecf44ff1d2a2c493f5f071fd662021a5aad9bcc19fd1a0ae

                                                                          SHA512

                                                                          786816ea352d0e8a062787ac27c989f12d7d884b6f8055012d7d2768399a952f46b1fae01cee748fb21264011eac0c8dcb1e1ab06321f7c0e6b88346aec35854

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • C:\Program Files\Common Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          09f6a6aa041a473dd524ebce5cd41593

                                                                          SHA1

                                                                          1a6ed6ba49e0f5302e611294ab0b33c7636e9cf2

                                                                          SHA256

                                                                          3d9ea2239dbfdcff7664ad9e68360731339c9123894a7762bcbf3a7d6c07467f

                                                                          SHA512

                                                                          3f467cabaf40585f3b9d74a50cc807b8e60160fb32f083d25be88ac271cf439689a9524a20892c56294497d7a69b398f35fda616ea22a2c68fbcdd7504de3e8e

                                                                        • C:\Program Files\Common Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          09f6a6aa041a473dd524ebce5cd41593

                                                                          SHA1

                                                                          1a6ed6ba49e0f5302e611294ab0b33c7636e9cf2

                                                                          SHA256

                                                                          3d9ea2239dbfdcff7664ad9e68360731339c9123894a7762bcbf3a7d6c07467f

                                                                          SHA512

                                                                          3f467cabaf40585f3b9d74a50cc807b8e60160fb32f083d25be88ac271cf439689a9524a20892c56294497d7a69b398f35fda616ea22a2c68fbcdd7504de3e8e

                                                                        • C:\Program Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6caa780dc3f1fca5a0caf6ccbc28bd20

                                                                          SHA1

                                                                          f08cadf671f52d83db8f0480c6da97f9700eb64b

                                                                          SHA256

                                                                          544303a3d7914d5ccefb6ff39d2ab48d191fad79d0090c16d88a04fa588f1043

                                                                          SHA512

                                                                          b03b9fea1c0e1ac5326d5f42eb9d48368fb4e2001c17e7c22e636ed041a2cb24c16a6240341e97b9d3c390db9fb15c47800fff730236716067313f22009d3435

                                                                        • C:\Program Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6caa780dc3f1fca5a0caf6ccbc28bd20

                                                                          SHA1

                                                                          f08cadf671f52d83db8f0480c6da97f9700eb64b

                                                                          SHA256

                                                                          544303a3d7914d5ccefb6ff39d2ab48d191fad79d0090c16d88a04fa588f1043

                                                                          SHA512

                                                                          b03b9fea1c0e1ac5326d5f42eb9d48368fb4e2001c17e7c22e636ed041a2cb24c16a6240341e97b9d3c390db9fb15c47800fff730236716067313f22009d3435

                                                                        • C:\Users\Admin\AppData\Local\Temp\4114709684\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • C:\Users\Admin\AppData\Local\Temp\4114709684\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          fe0b3396cc2ba1626b766fb3a2978b4a

                                                                          SHA1

                                                                          a427539c1d78585bf279ad5dca4f7f27d7ff17df

                                                                          SHA256

                                                                          757dc3944ba12f405ea6653287b5ab910d50ded4c05eb48d1970a71975b832f9

                                                                          SHA512

                                                                          32d90daaeecf8f749f902e16c5ea9c84be8152578cb225d9a5f2edbdc8f0aa1d609462f8622d288ec7fb0704899976392ed636cbf96cd44918ca905fd9098001

                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          1ad1a3d725b2c5f46f8fee6c16dd0ee4

                                                                          SHA1

                                                                          bbb3ac58bc7f64d12b5af9dac7282e7195d61592

                                                                          SHA256

                                                                          a4344eb5263be79fa502802e7e1d077ae9fadf82c2d843718f06bd4e285e7179

                                                                          SHA512

                                                                          5f83b7d2795caba9c49d0286ef9c034e48e6e0e6d34dad5bae3e9cdc86812cce697d4f4a0003d8f19ae4325e23e401ff0c3f790235a723922ca7b7e1e7bdfb0f

                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          002330b5b95b79f14ba589cd02de3857

                                                                          SHA1

                                                                          0683bdf02a6fc129ea74ce74f470940d95567940

                                                                          SHA256

                                                                          59ed2e0470aa557c8d08626120211bd3e4d0dfe073d09487b0c6bb5d1e4f5c77

                                                                          SHA512

                                                                          3adeb3601936f7b29bc4d9c7534e8a9a3460aedad8965f563f4302b3f664619ad2ec84b26b52b5d3089923497aba6b0b7aef03f324c79ae1828659854dc2afdb

                                                                        • C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6aa440d8602e1b111a1fd9fc3aa3bd1f

                                                                          SHA1

                                                                          8c99b2570494bb681dab61ad20985037feb0210a

                                                                          SHA256

                                                                          8d61022ddec4243f02f534a0519ef2ca4a8ff49a2592a3bf31fb3217f6338be6

                                                                          SHA512

                                                                          5a306fd18a6ecc7085588ad679de03b8d95de3e7b5f32b46ee3ac4e89e819b00dcfc703906e5af66f45504b40b10ea4f037d380a37be9ce6e9525a342d2019b5

                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6aa440d8602e1b111a1fd9fc3aa3bd1f

                                                                          SHA1

                                                                          8c99b2570494bb681dab61ad20985037feb0210a

                                                                          SHA256

                                                                          8d61022ddec4243f02f534a0519ef2ca4a8ff49a2592a3bf31fb3217f6338be6

                                                                          SHA512

                                                                          5a306fd18a6ecc7085588ad679de03b8d95de3e7b5f32b46ee3ac4e89e819b00dcfc703906e5af66f45504b40b10ea4f037d380a37be9ce6e9525a342d2019b5

                                                                        • C:\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          ba9f58db7025b87415faa2f760e36863

                                                                          SHA1

                                                                          4efefabff3c6ec009d8e63d2e1fedae5ad18b2b5

                                                                          SHA256

                                                                          4b6f26ff89073e356381100630d8b8f6723b98928e799911726d98e6cc3e5d50

                                                                          SHA512

                                                                          2d24abea0c5d70a50241f541c966e3503d910b96bbb2e183384997896947725eb78a983a915445b9b5720f25fdc4c1e48ecbd9bcf1180c3575b320379d41cb61

                                                                        • C:\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          ba9f58db7025b87415faa2f760e36863

                                                                          SHA1

                                                                          4efefabff3c6ec009d8e63d2e1fedae5ad18b2b5

                                                                          SHA256

                                                                          4b6f26ff89073e356381100630d8b8f6723b98928e799911726d98e6cc3e5d50

                                                                          SHA512

                                                                          2d24abea0c5d70a50241f541c966e3503d910b96bbb2e183384997896947725eb78a983a915445b9b5720f25fdc4c1e48ecbd9bcf1180c3575b320379d41cb61

                                                                        • \PerfLogs\Admin\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7878c4da1e602e990e8e93074fdd238f

                                                                          SHA1

                                                                          e1bdd96974f3ba7f467de3016897a55134436b64

                                                                          SHA256

                                                                          46f7cc61cdd81654fcb216d8f2aff0da323da5a194b1e6e78dd9fa1ceab4d2d5

                                                                          SHA512

                                                                          1a4c1c8b6ebb5f3dbcab1cae7d13deb3b738892ef7009af7e2b975fc7a8c4eb7f428272fd5570291f21a1e8274a7713cb42b25c6124a5c11e327c543cd005a56

                                                                        • \PerfLogs\Admin\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7878c4da1e602e990e8e93074fdd238f

                                                                          SHA1

                                                                          e1bdd96974f3ba7f467de3016897a55134436b64

                                                                          SHA256

                                                                          46f7cc61cdd81654fcb216d8f2aff0da323da5a194b1e6e78dd9fa1ceab4d2d5

                                                                          SHA512

                                                                          1a4c1c8b6ebb5f3dbcab1cae7d13deb3b738892ef7009af7e2b975fc7a8c4eb7f428272fd5570291f21a1e8274a7713cb42b25c6124a5c11e327c543cd005a56

                                                                        • \PerfLogs\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e5dd69fbb93ad50d5571efb563d5f8ea

                                                                          SHA1

                                                                          9a4748afd20faa8f0179fd91e254a5ab8bdfa42b

                                                                          SHA256

                                                                          ae64e5694607f1e17faee4981531d45aa193b7d5497f468a3f6f5ab710fbad23

                                                                          SHA512

                                                                          0992eca91973a690099de2ca3835d19ba7f5aee1b46f4ea04821e82017e86f3957740d5f69a381b487d0b86a534c7057187b78bbc701b180d28e7fc1fcaaf0f3

                                                                        • \PerfLogs\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e5dd69fbb93ad50d5571efb563d5f8ea

                                                                          SHA1

                                                                          9a4748afd20faa8f0179fd91e254a5ab8bdfa42b

                                                                          SHA256

                                                                          ae64e5694607f1e17faee4981531d45aa193b7d5497f468a3f6f5ab710fbad23

                                                                          SHA512

                                                                          0992eca91973a690099de2ca3835d19ba7f5aee1b46f4ea04821e82017e86f3957740d5f69a381b487d0b86a534c7057187b78bbc701b180d28e7fc1fcaaf0f3

                                                                        • \Program Files\7-Zip\Lang\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          304cb4be9ea0f74d906610c9485f4efa

                                                                          SHA1

                                                                          9b38ef8788decbacbaaa931a45ef4bd53dd6ba24

                                                                          SHA256

                                                                          f291ddc0770c1f58056d4d3b1e1edd4a1716ec9aa790f53e210975ef66c02a7b

                                                                          SHA512

                                                                          e3f9d38973b61817e7a4eba0d0f846fb14f25f92625156a6ad6b60e0b324c03e42b180e12b5b49d400a6afdf645d70aafc8244dc6b6e837548bda8ad3d1138d9

                                                                        • \Program Files\7-Zip\Lang\System Restore.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          304cb4be9ea0f74d906610c9485f4efa

                                                                          SHA1

                                                                          9b38ef8788decbacbaaa931a45ef4bd53dd6ba24

                                                                          SHA256

                                                                          f291ddc0770c1f58056d4d3b1e1edd4a1716ec9aa790f53e210975ef66c02a7b

                                                                          SHA512

                                                                          e3f9d38973b61817e7a4eba0d0f846fb14f25f92625156a6ad6b60e0b324c03e42b180e12b5b49d400a6afdf645d70aafc8244dc6b6e837548bda8ad3d1138d9

                                                                        • \Program Files\7-Zip\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          215f8dec92a22bc2d638661d453feea0

                                                                          SHA1

                                                                          273af4f133c8ee137eb35611052023765cd7a209

                                                                          SHA256

                                                                          9314bc3ae516ae9de21ce1b1f39095fec056dc124978ed4079ae00b619f8856b

                                                                          SHA512

                                                                          1721baa3adb009fd3c30844bda208b4ddcd6c565a1d2409b9245e2d03d8964482b90856fd269077592e6ad0bf1a29eb5aeaccaf966e7ccaa65b57d2ce832929f

                                                                        • \Program Files\7-Zip\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          215f8dec92a22bc2d638661d453feea0

                                                                          SHA1

                                                                          273af4f133c8ee137eb35611052023765cd7a209

                                                                          SHA256

                                                                          9314bc3ae516ae9de21ce1b1f39095fec056dc124978ed4079ae00b619f8856b

                                                                          SHA512

                                                                          1721baa3adb009fd3c30844bda208b4ddcd6c565a1d2409b9245e2d03d8964482b90856fd269077592e6ad0bf1a29eb5aeaccaf966e7ccaa65b57d2ce832929f

                                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e1fe46192f1eb45af028f35385770329

                                                                          SHA1

                                                                          c0554c95191e53b8063629bad03c2c638c4db98c

                                                                          SHA256

                                                                          57c2aa6e995276fc34aaf43ac6f56436156e54e799601b9e433780b84dcfe1e9

                                                                          SHA512

                                                                          98d128cd909992103eab9ee596a7f7188538a08668145fb7549e6b277fea811e1d11f35c7c2e045f0148af1fbd72e6a9c3a744c1080db252520f389306e56444

                                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          e1fe46192f1eb45af028f35385770329

                                                                          SHA1

                                                                          c0554c95191e53b8063629bad03c2c638c4db98c

                                                                          SHA256

                                                                          57c2aa6e995276fc34aaf43ac6f56436156e54e799601b9e433780b84dcfe1e9

                                                                          SHA512

                                                                          98d128cd909992103eab9ee596a7f7188538a08668145fb7549e6b277fea811e1d11f35c7c2e045f0148af1fbd72e6a9c3a744c1080db252520f389306e56444

                                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          9b6b5e584bff3e99bbc4e097e96e20a6

                                                                          SHA1

                                                                          b60b50b729738b225eee21f5df79321595ad3ee6

                                                                          SHA256

                                                                          46ce45bf97a3cb4aed344708aded80a0a8321a5cec853f3338b1f20fb7c6904d

                                                                          SHA512

                                                                          3cdcd22743de365ee06b7ef9c2fd8e911a85659a8dd5595e136e500da7d8f893005edef4f7892dfcf46716906f06cd82527e7a5a6cc02a9e8e6be50ae8275f28

                                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          9b6b5e584bff3e99bbc4e097e96e20a6

                                                                          SHA1

                                                                          b60b50b729738b225eee21f5df79321595ad3ee6

                                                                          SHA256

                                                                          46ce45bf97a3cb4aed344708aded80a0a8321a5cec853f3338b1f20fb7c6904d

                                                                          SHA512

                                                                          3cdcd22743de365ee06b7ef9c2fd8e911a85659a8dd5595e136e500da7d8f893005edef4f7892dfcf46716906f06cd82527e7a5a6cc02a9e8e6be50ae8275f28

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6e9bfe95e2722593de1393744ada5f90

                                                                          SHA1

                                                                          71a3f28417e56594f527049e77dc7f96cfe722d0

                                                                          SHA256

                                                                          39573aff5c97b720ecf44ff1d2a2c493f5f071fd662021a5aad9bcc19fd1a0ae

                                                                          SHA512

                                                                          786816ea352d0e8a062787ac27c989f12d7d884b6f8055012d7d2768399a952f46b1fae01cee748fb21264011eac0c8dcb1e1ab06321f7c0e6b88346aec35854

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6e9bfe95e2722593de1393744ada5f90

                                                                          SHA1

                                                                          71a3f28417e56594f527049e77dc7f96cfe722d0

                                                                          SHA256

                                                                          39573aff5c97b720ecf44ff1d2a2c493f5f071fd662021a5aad9bcc19fd1a0ae

                                                                          SHA512

                                                                          786816ea352d0e8a062787ac27c989f12d7d884b6f8055012d7d2768399a952f46b1fae01cee748fb21264011eac0c8dcb1e1ab06321f7c0e6b88346aec35854

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4056b138f015832a989565abd8556886

                                                                          SHA1

                                                                          e369d66c6a2a0124f666a8c34a5385a1887c11bd

                                                                          SHA256

                                                                          bcce0b718698f0d351219c82c6765d1062be76c2ea80ab53200d4f89fad322f5

                                                                          SHA512

                                                                          6f5bee694e213911b76d6f7f628ec668312f8600906019749ed33bbc72d18fe7545a8fb34985613ecbc11fc4a167d2c659677a78e9f996377e1f90a371e723bb

                                                                        • \Program Files\Common Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          09f6a6aa041a473dd524ebce5cd41593

                                                                          SHA1

                                                                          1a6ed6ba49e0f5302e611294ab0b33c7636e9cf2

                                                                          SHA256

                                                                          3d9ea2239dbfdcff7664ad9e68360731339c9123894a7762bcbf3a7d6c07467f

                                                                          SHA512

                                                                          3f467cabaf40585f3b9d74a50cc807b8e60160fb32f083d25be88ac271cf439689a9524a20892c56294497d7a69b398f35fda616ea22a2c68fbcdd7504de3e8e

                                                                        • \Program Files\Common Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          09f6a6aa041a473dd524ebce5cd41593

                                                                          SHA1

                                                                          1a6ed6ba49e0f5302e611294ab0b33c7636e9cf2

                                                                          SHA256

                                                                          3d9ea2239dbfdcff7664ad9e68360731339c9123894a7762bcbf3a7d6c07467f

                                                                          SHA512

                                                                          3f467cabaf40585f3b9d74a50cc807b8e60160fb32f083d25be88ac271cf439689a9524a20892c56294497d7a69b398f35fda616ea22a2c68fbcdd7504de3e8e

                                                                        • \Program Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6caa780dc3f1fca5a0caf6ccbc28bd20

                                                                          SHA1

                                                                          f08cadf671f52d83db8f0480c6da97f9700eb64b

                                                                          SHA256

                                                                          544303a3d7914d5ccefb6ff39d2ab48d191fad79d0090c16d88a04fa588f1043

                                                                          SHA512

                                                                          b03b9fea1c0e1ac5326d5f42eb9d48368fb4e2001c17e7c22e636ed041a2cb24c16a6240341e97b9d3c390db9fb15c47800fff730236716067313f22009d3435

                                                                        • \Program Files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6caa780dc3f1fca5a0caf6ccbc28bd20

                                                                          SHA1

                                                                          f08cadf671f52d83db8f0480c6da97f9700eb64b

                                                                          SHA256

                                                                          544303a3d7914d5ccefb6ff39d2ab48d191fad79d0090c16d88a04fa588f1043

                                                                          SHA512

                                                                          b03b9fea1c0e1ac5326d5f42eb9d48368fb4e2001c17e7c22e636ed041a2cb24c16a6240341e97b9d3c390db9fb15c47800fff730236716067313f22009d3435

                                                                        • \Users\Admin\AppData\Local\Temp\4114709684\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • \Users\Admin\AppData\Local\Temp\4114709684\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          fe0b3396cc2ba1626b766fb3a2978b4a

                                                                          SHA1

                                                                          a427539c1d78585bf279ad5dca4f7f27d7ff17df

                                                                          SHA256

                                                                          757dc3944ba12f405ea6653287b5ab910d50ded4c05eb48d1970a71975b832f9

                                                                          SHA512

                                                                          32d90daaeecf8f749f902e16c5ea9c84be8152578cb225d9a5f2edbdc8f0aa1d609462f8622d288ec7fb0704899976392ed636cbf96cd44918ca905fd9098001

                                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          fe0b3396cc2ba1626b766fb3a2978b4a

                                                                          SHA1

                                                                          a427539c1d78585bf279ad5dca4f7f27d7ff17df

                                                                          SHA256

                                                                          757dc3944ba12f405ea6653287b5ab910d50ded4c05eb48d1970a71975b832f9

                                                                          SHA512

                                                                          32d90daaeecf8f749f902e16c5ea9c84be8152578cb225d9a5f2edbdc8f0aa1d609462f8622d288ec7fb0704899976392ed636cbf96cd44918ca905fd9098001

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          1ad1a3d725b2c5f46f8fee6c16dd0ee4

                                                                          SHA1

                                                                          bbb3ac58bc7f64d12b5af9dac7282e7195d61592

                                                                          SHA256

                                                                          a4344eb5263be79fa502802e7e1d077ae9fadf82c2d843718f06bd4e285e7179

                                                                          SHA512

                                                                          5f83b7d2795caba9c49d0286ef9c034e48e6e0e6d34dad5bae3e9cdc86812cce697d4f4a0003d8f19ae4325e23e401ff0c3f790235a723922ca7b7e1e7bdfb0f

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\data.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          1ad1a3d725b2c5f46f8fee6c16dd0ee4

                                                                          SHA1

                                                                          bbb3ac58bc7f64d12b5af9dac7282e7195d61592

                                                                          SHA256

                                                                          a4344eb5263be79fa502802e7e1d077ae9fadf82c2d843718f06bd4e285e7179

                                                                          SHA512

                                                                          5f83b7d2795caba9c49d0286ef9c034e48e6e0e6d34dad5bae3e9cdc86812cce697d4f4a0003d8f19ae4325e23e401ff0c3f790235a723922ca7b7e1e7bdfb0f

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          002330b5b95b79f14ba589cd02de3857

                                                                          SHA1

                                                                          0683bdf02a6fc129ea74ce74f470940d95567940

                                                                          SHA256

                                                                          59ed2e0470aa557c8d08626120211bd3e4d0dfe073d09487b0c6bb5d1e4f5c77

                                                                          SHA512

                                                                          3adeb3601936f7b29bc4d9c7534e8a9a3460aedad8965f563f4302b3f664619ad2ec84b26b52b5d3089923497aba6b0b7aef03f324c79ae1828659854dc2afdb

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          002330b5b95b79f14ba589cd02de3857

                                                                          SHA1

                                                                          0683bdf02a6fc129ea74ce74f470940d95567940

                                                                          SHA256

                                                                          59ed2e0470aa557c8d08626120211bd3e4d0dfe073d09487b0c6bb5d1e4f5c77

                                                                          SHA512

                                                                          3adeb3601936f7b29bc4d9c7534e8a9a3460aedad8965f563f4302b3f664619ad2ec84b26b52b5d3089923497aba6b0b7aef03f324c79ae1828659854dc2afdb

                                                                        • \Users\Admin\AppData\Local\Temp\WPDNSE\data.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6aa440d8602e1b111a1fd9fc3aa3bd1f

                                                                          SHA1

                                                                          8c99b2570494bb681dab61ad20985037feb0210a

                                                                          SHA256

                                                                          8d61022ddec4243f02f534a0519ef2ca4a8ff49a2592a3bf31fb3217f6338be6

                                                                          SHA512

                                                                          5a306fd18a6ecc7085588ad679de03b8d95de3e7b5f32b46ee3ac4e89e819b00dcfc703906e5af66f45504b40b10ea4f037d380a37be9ce6e9525a342d2019b5

                                                                        • \Users\Admin\AppData\Local\Temp\WPDNSE\data.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6aa440d8602e1b111a1fd9fc3aa3bd1f

                                                                          SHA1

                                                                          8c99b2570494bb681dab61ad20985037feb0210a

                                                                          SHA256

                                                                          8d61022ddec4243f02f534a0519ef2ca4a8ff49a2592a3bf31fb3217f6338be6

                                                                          SHA512

                                                                          5a306fd18a6ecc7085588ad679de03b8d95de3e7b5f32b46ee3ac4e89e819b00dcfc703906e5af66f45504b40b10ea4f037d380a37be9ce6e9525a342d2019b5

                                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          4bc933f4261a3c487ea21bf22f856de8

                                                                          SHA1

                                                                          e460a3c9a095ab5de64db2b417fa1d80ba86c23a

                                                                          SHA256

                                                                          8be60df942beec6dbaf7fe07edf7c7b04b7d22f3846ea6e13882186b76d21b97

                                                                          SHA512

                                                                          f16f66d9e326671fc04190113d1c7450107ee318a9014d0d70cb12fb760847371ee5d201d54c1782c9150cc2f053577c4cfebec78ddff1bc675ab4b9bf777896

                                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6aa440d8602e1b111a1fd9fc3aa3bd1f

                                                                          SHA1

                                                                          8c99b2570494bb681dab61ad20985037feb0210a

                                                                          SHA256

                                                                          8d61022ddec4243f02f534a0519ef2ca4a8ff49a2592a3bf31fb3217f6338be6

                                                                          SHA512

                                                                          5a306fd18a6ecc7085588ad679de03b8d95de3e7b5f32b46ee3ac4e89e819b00dcfc703906e5af66f45504b40b10ea4f037d380a37be9ce6e9525a342d2019b5

                                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          6aa440d8602e1b111a1fd9fc3aa3bd1f

                                                                          SHA1

                                                                          8c99b2570494bb681dab61ad20985037feb0210a

                                                                          SHA256

                                                                          8d61022ddec4243f02f534a0519ef2ca4a8ff49a2592a3bf31fb3217f6338be6

                                                                          SHA512

                                                                          5a306fd18a6ecc7085588ad679de03b8d95de3e7b5f32b46ee3ac4e89e819b00dcfc703906e5af66f45504b40b10ea4f037d380a37be9ce6e9525a342d2019b5

                                                                        • memory/564-184-0x0000000073F11000-0x0000000073F13000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                        • memory/564-137-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

                                                                          Filesize

                                                                          8KB