Overview

overview

10

Static

static

eced429f4c...ef.exe

windows7-x64

10

eced429f4c...ef.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    152s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 16:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    eced429f4cdecfafb41861a8468664f3108bb7994d5cc43029eaeee7dc8162ef.exe

  • Size

    72KB

  • MD5

    04c7c414f0c9de79902b66e19e480b86

  • SHA1

    f7967c9085bf4b14c186da784c97ba65aac95848

  • SHA256

    eced429f4cdecfafb41861a8468664f3108bb7994d5cc43029eaeee7dc8162ef

  • SHA512

    16d1360572d6744e3042844e49a924c66e213c7e0ee2b4eb3ba0ed215a84149bdfa6b307367f7612b8d3938f2f9a2f4f1e41dc7cc492e1b4f29072007514f408

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2V:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPh

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\eced429f4cdecfafb41861a8468664f3108bb7994d5cc43029eaeee7dc8162ef.exe
    "C:\Users\Admin\AppData\Local\Temp\eced429f4cdecfafb41861a8468664f3108bb7994d5cc43029eaeee7dc8162ef.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1628
    • C:\Users\Admin\AppData\Local\Temp\2337514601\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2337514601\backup.exe C:\Users\Admin\AppData\Local\Temp\2337514601\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:1556
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1528
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:548
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1924
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1948
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:1104
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1300
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:640
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:332
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1468
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                PID:272
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:792
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:368
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1316
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1940
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1392
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:968
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1464
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1776
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1720
                • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1232
                • C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1808
                • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Drops file in Program Files directory
                  • Suspicious use of SetWindowsHookEx
                  PID:1700
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:240
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:328
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1480
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    PID:1964
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:2020
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1924
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
                    9⤵
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:524
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:1864
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
                    9⤵
                    • Modifies visibility of file extensions in Explorer
                    • Executes dropped EXE
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:832
                • C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1268
                • C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:708
                • C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1580
                • C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:472
                • C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1340
                • C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1736
                • C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1636
                • C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • System policy modification
                  PID:1568
                • C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:872
                • C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1616
                • C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:844
                • C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:632
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1452
                • C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1744
                • C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:960
                • C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1116
                • C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1756
                • C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1136
                • C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1732
                • C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2000
                • C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
                  8⤵
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1352
                • C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1600
                • C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:240
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1484
                • C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1480
              • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                7⤵
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1964
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                  8⤵
                  • System policy modification
                  PID:2020
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                  8⤵
                  • System policy modification
                  PID:1784
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:1992
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                  8⤵
                  • System policy modification
                  PID:568
                • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                  8⤵
                    PID:1704
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                    8⤵
                    • System policy modification
                    PID:1360
                • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                  7⤵
                  • Disables RegEdit via registry modification
                  • System policy modification
                  PID:1868
                  • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                    8⤵
                    • Disables RegEdit via registry modification
                    • System policy modification
                    PID:1268
                • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • System policy modification
                  PID:1804
                • C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe
                  "C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  PID:600
                • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                  7⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Drops file in Program Files directory
                  PID:584
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    PID:1536
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    PID:1340
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\update.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                    8⤵
                    • Modifies visibility of file extensions in Explorer
                    • System policy modification
                    PID:980
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
                    8⤵
                    • Disables RegEdit via registry modification
                    PID:1956
                  • C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
                    8⤵
                      PID:1568
                    • C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
                      8⤵
                        PID:1624
                    • C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe
                      "C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Drops file in Program Files directory
                      PID:1880
                      • C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
                        8⤵
                          PID:1328
                        • C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          PID:860
                        • C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • System policy modification
                          PID:1464
                        • C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
                          8⤵
                            PID:944
                          • C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
                            8⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:1816
                          • C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
                            8⤵
                              PID:1360
                          • C:\Program Files\Common Files\Microsoft Shared\VC\data.exe
                            "C:\Program Files\Common Files\Microsoft Shared\VC\data.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:2016
                          • C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            PID:1136
                          • C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Drops file in Program Files directory
                            • System policy modification
                            PID:1352
                            • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
                              8⤵
                              • Disables RegEdit via registry modification
                              PID:1480
                              • C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\System Restore.exe
                                "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
                                9⤵
                                  PID:1048
                          • C:\Program Files\Common Files\Services\backup.exe
                            "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                            6⤵
                            • Disables RegEdit via registry modification
                            PID:848
                          • C:\Program Files\Common Files\SpeechEngines\backup.exe
                            "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                            6⤵
                            • Modifies visibility of file extensions in Explorer
                            PID:1728
                            • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                              "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                              7⤵
                              • Drops file in Program Files directory
                              PID:1760
                          • C:\Program Files\Common Files\System\data.exe
                            "C:\Program Files\Common Files\System\data.exe" C:\Program Files\Common Files\System\
                            6⤵
                            • Disables RegEdit via registry modification
                            • Drops file in Program Files directory
                            • System policy modification
                            PID:1696
                            • C:\Program Files\Common Files\System\ado\backup.exe
                              "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                              7⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Drops file in Program Files directory
                              • System policy modification
                              PID:1856
                              • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                8⤵
                                  PID:2032
                                • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                  "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                  8⤵
                                    PID:1072
                                  • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                    "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                    8⤵
                                      PID:1168
                                    • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                      "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                      8⤵
                                        PID:572
                                      • C:\Program Files\Common Files\System\ado\it-IT\backup.exe
                                        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
                                        8⤵
                                          PID:1340
                                      • C:\Program Files\Common Files\System\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                        7⤵
                                          PID:1448
                                        • C:\Program Files\Common Files\System\en-US\backup.exe
                                          "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                          7⤵
                                            PID:1488
                                          • C:\Program Files\Common Files\System\es-ES\data.exe
                                            "C:\Program Files\Common Files\System\es-ES\data.exe" C:\Program Files\Common Files\System\es-ES\
                                            7⤵
                                              PID:240
                                        • C:\Program Files\DVD Maker\backup.exe
                                          "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Drops file in Program Files directory
                                          • System policy modification
                                          PID:1452
                                          • C:\Program Files\DVD Maker\de-DE\backup.exe
                                            "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                            6⤵
                                            • Disables RegEdit via registry modification
                                            PID:1752
                                          • C:\Program Files\DVD Maker\en-US\backup.exe
                                            "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • System policy modification
                                            PID:1588
                                          • C:\Program Files\DVD Maker\es-ES\backup.exe
                                            "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                            6⤵
                                            • System policy modification
                                            PID:424
                                          • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                            "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                            6⤵
                                            • System policy modification
                                            PID:1596
                                          • C:\Program Files\DVD Maker\it-IT\backup.exe
                                            "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                            6⤵
                                              PID:1804
                                            • C:\Program Files\DVD Maker\ja-JP\System Restore.exe
                                              "C:\Program Files\DVD Maker\ja-JP\System Restore.exe" C:\Program Files\DVD Maker\ja-JP\
                                              6⤵
                                              • System policy modification
                                              PID:1952
                                            • C:\Program Files\DVD Maker\Shared\backup.exe
                                              "C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
                                              6⤵
                                              • Modifies visibility of file extensions in Explorer
                                              • Disables RegEdit via registry modification
                                              PID:1560
                                              • C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
                                                "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
                                                7⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • System policy modification
                                                PID:1936
                                                • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
                                                  "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
                                                  8⤵
                                                    PID:1132
                                                  • C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
                                                    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
                                                    8⤵
                                                      PID:1756
                                                    • C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
                                                      "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
                                                      8⤵
                                                        PID:1656
                                                • C:\Program Files\Google\update.exe
                                                  "C:\Program Files\Google\update.exe" C:\Program Files\Google\
                                                  5⤵
                                                    PID:844
                                                  • C:\Program Files\Internet Explorer\backup.exe
                                                    "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                    5⤵
                                                      PID:1204
                                                    • C:\Program Files\Java\backup.exe
                                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                      5⤵
                                                        PID:1960
                                                      • C:\Program Files\Microsoft Games\backup.exe
                                                        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                        5⤵
                                                          PID:1536
                                                      • C:\Program Files (x86)\backup.exe
                                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                        4⤵
                                                        • Disables RegEdit via registry modification
                                                        • Drops file in Program Files directory
                                                        PID:1316
                                                        • C:\Program Files (x86)\Adobe\System Restore.exe
                                                          "C:\Program Files (x86)\Adobe\System Restore.exe" C:\Program Files (x86)\Adobe\
                                                          5⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Drops file in Program Files directory
                                                          PID:1012
                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                            6⤵
                                                            • Drops file in Program Files directory
                                                            • System policy modification
                                                            PID:592
                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe
                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                              7⤵
                                                              • Modifies visibility of file extensions in Explorer
                                                              PID:1784
                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                              7⤵
                                                              • Drops file in Program Files directory
                                                              PID:1128
                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • System policy modification
                                                                PID:676
                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
                                                                8⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • System policy modification
                                                                PID:1340
                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                • System policy modification
                                                                PID:1636
                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe
                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
                                                                8⤵
                                                                • Disables RegEdit via registry modification
                                                                • Drops file in Program Files directory
                                                                PID:792
                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
                                                                  9⤵
                                                                    PID:2016
                                                                • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe
                                                                  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
                                                                  8⤵
                                                                    PID:2036
                                                                  • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
                                                                    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
                                                                    8⤵
                                                                      PID:1588
                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
                                                                      8⤵
                                                                        PID:872
                                                                    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                      7⤵
                                                                        PID:1328
                                                                      • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                        7⤵
                                                                          PID:1732
                                                                    • C:\Program Files (x86)\Common Files\backup.exe
                                                                      "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                      5⤵
                                                                        PID:1372
                                                                      • C:\Program Files (x86)\Google\backup.exe
                                                                        "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                        5⤵
                                                                          PID:1476
                                                                        • C:\Program Files (x86)\Internet Explorer\backup.exe
                                                                          "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
                                                                          5⤵
                                                                            PID:1740
                                                                          • C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
                                                                            "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
                                                                            5⤵
                                                                              PID:1624
                                                                          • C:\Users\data.exe
                                                                            C:\Users\data.exe C:\Users\
                                                                            4⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            PID:1324
                                                                            • C:\Users\Admin\update.exe
                                                                              C:\Users\Admin\update.exe C:\Users\Admin\
                                                                              5⤵
                                                                                PID:472
                                                                            • C:\Windows\backup.exe
                                                                              C:\Windows\backup.exe C:\Windows\
                                                                              4⤵
                                                                                PID:1252
                                                                          • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1940
                                                                          • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1284
                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1116
                                                                          • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:912
                                                                          • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Disables RegEdit via registry modification
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:1232
                                                                          • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                            2⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            • System policy modification
                                                                            PID:1748

                                                                        Network

                                                                        MITRE ATT&CK Enterprise v6

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        • C:\PerfLogs\Admin\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0eb44837ac16f2dbb25d28e82ae5c52a

                                                                          SHA1

                                                                          733f3239d45aae05c95d3fde41b80cc15eef535a

                                                                          SHA256

                                                                          3e8afec54d4817d33fd7fdfff3a107adc76e163ef03383e1ef1442b0c98aedf0

                                                                          SHA512

                                                                          5dbcb04f3ff003a31f1a11e76be29e9845175e5fc51ca03d1cf14c9fbbe83ff9514fd4259e34774ea72c2e2a886936fd49cb401f1f11b4d1235d72035ab1063f

                                                                          Download Submit

                                                                        • C:\PerfLogs\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          851a095f74c6cff9c1556d30bf32a158

                                                                          SHA1

                                                                          282ec0aeef0037a10819da7a097f93e760b95495

                                                                          SHA256

                                                                          44b50f6c85af4638b0336d7b2e19641a3ffc867529e2f7f292e7f06eab79f10f

                                                                          SHA512

                                                                          48ca2268241898e3b04253790cce3d16874fee628e0807131a348292a722452aed3a51556f20d8d48ba366479735dd99e0067d44aa40823e667d8dd96358c525

                                                                          Download Submit

                                                                        • C:\PerfLogs\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          851a095f74c6cff9c1556d30bf32a158

                                                                          SHA1

                                                                          282ec0aeef0037a10819da7a097f93e760b95495

                                                                          SHA256

                                                                          44b50f6c85af4638b0336d7b2e19641a3ffc867529e2f7f292e7f06eab79f10f

                                                                          SHA512

                                                                          48ca2268241898e3b04253790cce3d16874fee628e0807131a348292a722452aed3a51556f20d8d48ba366479735dd99e0067d44aa40823e667d8dd96358c525

                                                                          Download Submit

                                                                        • C:\Program Files\7-Zip\Lang\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • C:\Program Files\7-Zip\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          db06c511c07874d81800e918920fe0cc

                                                                          SHA1

                                                                          768e7a724fc4ae7553bb871fe8aefd19a44b6c83

                                                                          SHA256

                                                                          26287e630a542c35012c4761187e1db31ca0b22ff1a3c8b97bf825d9f2dfc303

                                                                          SHA512

                                                                          630205f8d67cef8366c3f2b72146981014282e4b41570297e2e35f125eed1e1987a06a70400e6e724bd0142492adfe8fbf5941360fd37ead84047ffa3b84dfd1

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          d81901f186f5fbee57341f4514239467

                                                                          SHA1

                                                                          81887cf53024b2dc4fdea004042e00799732c3ec

                                                                          SHA256

                                                                          3b147d7a506ffebe71b9b9389f131655d6159fa80ab3423e0bff3e0c416b91db

                                                                          SHA512

                                                                          7dbb475df6f82efd9b8f75231b9dce0ef31da304ead9639bd2f4bf7697fdb3693f83f5c9701dfa99d1c1374eb1187529c23af11f6d71170ae78a80e3c08ff691

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          d81901f186f5fbee57341f4514239467

                                                                          SHA1

                                                                          81887cf53024b2dc4fdea004042e00799732c3ec

                                                                          SHA256

                                                                          3b147d7a506ffebe71b9b9389f131655d6159fa80ab3423e0bff3e0c416b91db

                                                                          SHA512

                                                                          7dbb475df6f82efd9b8f75231b9dce0ef31da304ead9639bd2f4bf7697fdb3693f83f5c9701dfa99d1c1374eb1187529c23af11f6d71170ae78a80e3c08ff691

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • C:\Program Files\Common Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • C:\Program Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          b37312a02268e71a56583fd87170f727

                                                                          SHA1

                                                                          50205571e1ff24a20142371a3a4dd7688629a6ff

                                                                          SHA256

                                                                          90a82e3965c28bf94e8dcf783eef9ff81e616da750ac73fc0c16ac31387f0caa

                                                                          SHA512

                                                                          9100af889d8368cba05db84e78745327e16d5a9a8521300addf63cd502c2609801a838b8a3034166109f35dfeeb3bca895654877eeba8e0dfe44f3fb73f9abca

                                                                          Download Submit

                                                                        • C:\Program Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          b37312a02268e71a56583fd87170f727

                                                                          SHA1

                                                                          50205571e1ff24a20142371a3a4dd7688629a6ff

                                                                          SHA256

                                                                          90a82e3965c28bf94e8dcf783eef9ff81e616da750ac73fc0c16ac31387f0caa

                                                                          SHA512

                                                                          9100af889d8368cba05db84e78745327e16d5a9a8521300addf63cd502c2609801a838b8a3034166109f35dfeeb3bca895654877eeba8e0dfe44f3fb73f9abca

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\2337514601\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\2337514601\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • C:\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          485a7feab34bc953ab479497b0333ab1

                                                                          SHA1

                                                                          4e91538159263921f384a63c5c1f161555278114

                                                                          SHA256

                                                                          b4382ff4802218286632213cf67e2049ce94e798faf6020bfbea4ac90718039d

                                                                          SHA512

                                                                          24e43cb3a204f425a044d4b0f18ab3d85da72e1caf8ac966aa3951021b95cd5460bc333891d250a79c63de9671258c017ec4fac651e59f0cea0530e63b0e052b

                                                                          Download Submit

                                                                        • C:\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          485a7feab34bc953ab479497b0333ab1

                                                                          SHA1

                                                                          4e91538159263921f384a63c5c1f161555278114

                                                                          SHA256

                                                                          b4382ff4802218286632213cf67e2049ce94e798faf6020bfbea4ac90718039d

                                                                          SHA512

                                                                          24e43cb3a204f425a044d4b0f18ab3d85da72e1caf8ac966aa3951021b95cd5460bc333891d250a79c63de9671258c017ec4fac651e59f0cea0530e63b0e052b

                                                                          Download Submit

                                                                        • \PerfLogs\Admin\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0eb44837ac16f2dbb25d28e82ae5c52a

                                                                          SHA1

                                                                          733f3239d45aae05c95d3fde41b80cc15eef535a

                                                                          SHA256

                                                                          3e8afec54d4817d33fd7fdfff3a107adc76e163ef03383e1ef1442b0c98aedf0

                                                                          SHA512

                                                                          5dbcb04f3ff003a31f1a11e76be29e9845175e5fc51ca03d1cf14c9fbbe83ff9514fd4259e34774ea72c2e2a886936fd49cb401f1f11b4d1235d72035ab1063f

                                                                          Download Submit

                                                                        • \PerfLogs\Admin\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0eb44837ac16f2dbb25d28e82ae5c52a

                                                                          SHA1

                                                                          733f3239d45aae05c95d3fde41b80cc15eef535a

                                                                          SHA256

                                                                          3e8afec54d4817d33fd7fdfff3a107adc76e163ef03383e1ef1442b0c98aedf0

                                                                          SHA512

                                                                          5dbcb04f3ff003a31f1a11e76be29e9845175e5fc51ca03d1cf14c9fbbe83ff9514fd4259e34774ea72c2e2a886936fd49cb401f1f11b4d1235d72035ab1063f

                                                                          Download Submit

                                                                        • \PerfLogs\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          851a095f74c6cff9c1556d30bf32a158

                                                                          SHA1

                                                                          282ec0aeef0037a10819da7a097f93e760b95495

                                                                          SHA256

                                                                          44b50f6c85af4638b0336d7b2e19641a3ffc867529e2f7f292e7f06eab79f10f

                                                                          SHA512

                                                                          48ca2268241898e3b04253790cce3d16874fee628e0807131a348292a722452aed3a51556f20d8d48ba366479735dd99e0067d44aa40823e667d8dd96358c525

                                                                          Download Submit

                                                                        • \PerfLogs\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          851a095f74c6cff9c1556d30bf32a158

                                                                          SHA1

                                                                          282ec0aeef0037a10819da7a097f93e760b95495

                                                                          SHA256

                                                                          44b50f6c85af4638b0336d7b2e19641a3ffc867529e2f7f292e7f06eab79f10f

                                                                          SHA512

                                                                          48ca2268241898e3b04253790cce3d16874fee628e0807131a348292a722452aed3a51556f20d8d48ba366479735dd99e0067d44aa40823e667d8dd96358c525

                                                                          Download Submit

                                                                        • \Program Files\7-Zip\Lang\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • \Program Files\7-Zip\Lang\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • \Program Files\7-Zip\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • \Program Files\7-Zip\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          db06c511c07874d81800e918920fe0cc

                                                                          SHA1

                                                                          768e7a724fc4ae7553bb871fe8aefd19a44b6c83

                                                                          SHA256

                                                                          26287e630a542c35012c4761187e1db31ca0b22ff1a3c8b97bf825d9f2dfc303

                                                                          SHA512

                                                                          630205f8d67cef8366c3f2b72146981014282e4b41570297e2e35f125eed1e1987a06a70400e6e724bd0142492adfe8fbf5941360fd37ead84047ffa3b84dfd1

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          db06c511c07874d81800e918920fe0cc

                                                                          SHA1

                                                                          768e7a724fc4ae7553bb871fe8aefd19a44b6c83

                                                                          SHA256

                                                                          26287e630a542c35012c4761187e1db31ca0b22ff1a3c8b97bf825d9f2dfc303

                                                                          SHA512

                                                                          630205f8d67cef8366c3f2b72146981014282e4b41570297e2e35f125eed1e1987a06a70400e6e724bd0142492adfe8fbf5941360fd37ead84047ffa3b84dfd1

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          7cc15db956966951e24d5172afd2e11f

                                                                          SHA1

                                                                          e8ac29e2858243e4821f69ef883115b0db7db9cd

                                                                          SHA256

                                                                          ef9dc8443933f189d2c812606c1110c48bba7249b46d39b926f96bf7ed3edacc

                                                                          SHA512

                                                                          87f015b260383ee521a2154a5fdbf3d4b498752208d8b4f2bf4a85f81270db30e86e393f2246e830684fb7232f33dad22f863b711e0ed59ad448cd4f3a635ba0

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          d81901f186f5fbee57341f4514239467

                                                                          SHA1

                                                                          81887cf53024b2dc4fdea004042e00799732c3ec

                                                                          SHA256

                                                                          3b147d7a506ffebe71b9b9389f131655d6159fa80ab3423e0bff3e0c416b91db

                                                                          SHA512

                                                                          7dbb475df6f82efd9b8f75231b9dce0ef31da304ead9639bd2f4bf7697fdb3693f83f5c9701dfa99d1c1374eb1187529c23af11f6d71170ae78a80e3c08ff691

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          d81901f186f5fbee57341f4514239467

                                                                          SHA1

                                                                          81887cf53024b2dc4fdea004042e00799732c3ec

                                                                          SHA256

                                                                          3b147d7a506ffebe71b9b9389f131655d6159fa80ab3423e0bff3e0c416b91db

                                                                          SHA512

                                                                          7dbb475df6f82efd9b8f75231b9dce0ef31da304ead9639bd2f4bf7697fdb3693f83f5c9701dfa99d1c1374eb1187529c23af11f6d71170ae78a80e3c08ff691

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          f3a2338dccf62c962178b8ac9da946b5

                                                                          SHA1

                                                                          4826086fb989b123c30dfd5cca7875e63563bd60

                                                                          SHA256

                                                                          53e178783238acc1bf9a32f30650c46b12be73964e6771c64ca33d3ea0b72a74

                                                                          SHA512

                                                                          1e7019ae46b79750d1f6eafda2c07a12345b7fc7e2229e5198a2ce273df7d2cc2e6abe71dbbbcb2f8d3f6055cf27161eee3df129f6ef5b5fe5646e59247861de

                                                                          Download Submit

                                                                        • \Program Files\Common Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • \Program Files\Common Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          8f8b45e71f80bfa266391940d48c6dee

                                                                          SHA1

                                                                          aa5a5677f1338916bbd38e91e90c425df652f62f

                                                                          SHA256

                                                                          37248766272bbbe4d1a20291ac58794f9e3b6e8aecc39c9f7acdf903bcda2f7f

                                                                          SHA512

                                                                          afcca0544e777cf2f4ce7d97414179db428aa740633b6990ea18e3c30d8154fa81156f78e267b26319e6223ae633958ec04b38c035ce22fffbe6274ffbc37ba2

                                                                          Download Submit

                                                                        • \Program Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          b37312a02268e71a56583fd87170f727

                                                                          SHA1

                                                                          50205571e1ff24a20142371a3a4dd7688629a6ff

                                                                          SHA256

                                                                          90a82e3965c28bf94e8dcf783eef9ff81e616da750ac73fc0c16ac31387f0caa

                                                                          SHA512

                                                                          9100af889d8368cba05db84e78745327e16d5a9a8521300addf63cd502c2609801a838b8a3034166109f35dfeeb3bca895654877eeba8e0dfe44f3fb73f9abca

                                                                          Download Submit

                                                                        • \Program Files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          b37312a02268e71a56583fd87170f727

                                                                          SHA1

                                                                          50205571e1ff24a20142371a3a4dd7688629a6ff

                                                                          SHA256

                                                                          90a82e3965c28bf94e8dcf783eef9ff81e616da750ac73fc0c16ac31387f0caa

                                                                          SHA512

                                                                          9100af889d8368cba05db84e78745327e16d5a9a8521300addf63cd502c2609801a838b8a3034166109f35dfeeb3bca895654877eeba8e0dfe44f3fb73f9abca

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\2337514601\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\2337514601\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          90d3486eca894a75d97f77d2c7019396

                                                                          SHA1

                                                                          c6839ca9417c48fa8ce6942ad49b80477b967121

                                                                          SHA256

                                                                          bdefd4fbf626bd274dab0e4e3f452b184750070d83adbaa8d382b558a91cb6df

                                                                          SHA512

                                                                          628fe0ad74de7fc72434450d292b4ee56d29e51fcd1176032b082fd5e7a065e1630aed0b9735affb6449442031ce3c2fbe90261966490f8d0f30acf4c7336be9

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                                          Filesize

                                                                          72KB

                                                                          MD5

                                                                          0d1d3f23e0fa1a4e67327ffda8a0d4ed

                                                                          SHA1

                                                                          e9586ed080fc9f74b29fa0832d27d043b7bcdaa1

                                                                          SHA256

                                                                          1a295b7fff4df9d5a828f79e6ff63dcbac87ca4203bf6b94e63151ff74969906

                                                                          SHA512

                                                                          bd70b069a681da1674112fda45a00c8c0a938d8ffdcd031e74c1593eb829f5e109bee7f75f2210eedff187ba049fb8158a79bd06ffebc5ef34307daeb7a5ce7d

                                                                          Download Submit

                                                                        • memory/1628-98-0x0000000074AD1000-0x0000000074AD3000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download

                                                                        • memory/1628-118-0x0000000073F11000-0x0000000073F13000-memory.dmp

                                                                          Filesize

                                                                          8KB

                                                                          Download