Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

f1302fb833...2d.exe

windows7-x64

10

f1302fb833...2d.exe

windows10-2004-x64

Analysis

  • max time kernel
    275s
  • max time network
    336s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 16:34

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f1302fb833594f1ca40fa95d3811fc2aadd853206fe92f390667ca858b6df72d.exe

  • Size

    72KB

  • MD5

    0c73401a72570d0ea06eaf70644bf9b6

  • SHA1

    d16df9a97541df5c9d8df2bbd6c86a030e9b35ef

  • SHA256

    f1302fb833594f1ca40fa95d3811fc2aadd853206fe92f390667ca858b6df72d

  • SHA512

    716bad37ce37fcf8e27b648378a37862eb529d5a1bdd8ed7d41a3fa356d7360258b162843cf322e583c51122e84bf1c17c26d6b227a3195041d9f73622f2c7d9

  • SSDEEP

    768:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPp3:ieTce/U/hKYuKPp3

Score
10/10
evasion

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
    evasion
  • Disables RegEdit via registry modification 64 IoCs
    evasion
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\f1302fb833594f1ca40fa95d3811fc2aadd853206fe92f390667ca858b6df72d.exe
    "C:\Users\Admin\AppData\Local\Temp\f1302fb833594f1ca40fa95d3811fc2aadd853206fe92f390667ca858b6df72d.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:436
    • C:\Users\Admin\AppData\Local\Temp\2303785755\backup.exe
      C:\Users\Admin\AppData\Local\Temp\2303785755\backup.exe C:\Users\Admin\AppData\Local\Temp\2303785755\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:904
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1136
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:768
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            PID:1956
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1040
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:888
            • C:\Program Files\7-Zip\Lang\data.exe
              "C:\Program Files\7-Zip\Lang\data.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              PID:1404
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:2036
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:592
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • System policy modification
                PID:1912
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1676
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1112
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:316
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:396
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:1192
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:768
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:956
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1272
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                    PID:1524
                  • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                    8⤵
                      PID:1916
                    • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                      8⤵
                        PID:1956
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                      7⤵
                      • Modifies visibility of file extensions in Explorer
                      • Executes dropped EXE
                      • Drops file in Program Files directory
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:672
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1600
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        PID:1780
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                        8⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Suspicious use of SetWindowsHookEx
                        • System policy modification
                        PID:1340
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                        8⤵
                          PID:1308
                        • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                          8⤵
                            PID:652
                          • C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
                            8⤵
                              PID:188
                          • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            PID:1096
                            • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe
                              "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\data.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                              8⤵
                              • Modifies visibility of file extensions in Explorer
                              • Disables RegEdit via registry modification
                              • Executes dropped EXE
                              • Suspicious use of SetWindowsHookEx
                              • System policy modification
                              PID:1696
                          • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\data.exe
                            "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\data.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1228
                          • C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe
                            "C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:992
                          • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                            "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1616
                            • C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
                              "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
                              8⤵
                                PID:1972
                              • C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
                                "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
                                8⤵
                                  PID:928
                                • C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
                                  8⤵
                                    PID:1324
                                • C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe
                                  "C:\Program Files\Common Files\Microsoft Shared\Triedit\update.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
                                  7⤵
                                    PID:944
                                  • C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
                                    "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
                                    7⤵
                                      PID:856
                                  • C:\Program Files\Common Files\Services\backup.exe
                                    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1620
                                  • C:\Program Files\Common Files\SpeechEngines\backup.exe
                                    "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:2012
                                    • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                                      "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:652
                                  • C:\Program Files\Common Files\System\backup.exe
                                    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                                    6⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:1968
                                    • C:\Program Files\Common Files\System\ado\backup.exe
                                      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
                                      7⤵
                                      • Modifies visibility of file extensions in Explorer
                                      • Disables RegEdit via registry modification
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Suspicious use of SetWindowsHookEx
                                      • System policy modification
                                      PID:1112
                                      • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                                        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                                        8⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Executes dropped EXE
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:1540
                                      • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                        8⤵
                                        • Executes dropped EXE
                                        PID:924
                                      • C:\Program Files\Common Files\System\ado\es-ES\backup.exe
                                        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
                                        8⤵
                                          PID:1708
                                        • C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
                                          "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
                                          8⤵
                                            PID:1680
                                        • C:\Program Files\Common Files\System\de-DE\backup.exe
                                          "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                          7⤵
                                            PID:748
                                          • C:\Program Files\Common Files\System\en-US\backup.exe
                                            "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                            7⤵
                                              PID:1460
                                        • C:\Program Files\DVD Maker\backup.exe
                                          "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          PID:916
                                          • C:\Program Files\DVD Maker\de-DE\backup.exe
                                            "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Disables RegEdit via registry modification
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1584
                                          • C:\Program Files\DVD Maker\en-US\backup.exe
                                            "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:1944
                                          • C:\Program Files\DVD Maker\es-ES\backup.exe
                                            "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                            6⤵
                                            • Modifies visibility of file extensions in Explorer
                                            • Executes dropped EXE
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:108
                                          • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                            "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                            6⤵
                                              PID:616
                                            • C:\Program Files\DVD Maker\it-IT\backup.exe
                                              "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                              6⤵
                                                PID:1580
                                              • C:\Program Files\DVD Maker\ja-JP\backup.exe
                                                "C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
                                                6⤵
                                                  PID:1684
                                              • C:\Program Files\Google\backup.exe
                                                "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                                5⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:1652
                                                • C:\Program Files\Google\Chrome\backup.exe
                                                  "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                                  6⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:1688
                                                  • C:\Program Files\Google\Chrome\Application\backup.exe
                                                    "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
                                                    7⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1648
                                                    • C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe
                                                      "C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\
                                                      8⤵
                                                      • Modifies visibility of file extensions in Explorer
                                                      • Disables RegEdit via registry modification
                                                      • Executes dropped EXE
                                                      • Drops file in Program Files directory
                                                      • Suspicious use of SetWindowsHookEx
                                                      • System policy modification
                                                      PID:1700
                                                      • C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe
                                                        "C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\
                                                        9⤵
                                                          PID:2008
                                                        • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe
                                                          "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\
                                                          9⤵
                                                            PID:1560
                                                          • C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\
                                                            9⤵
                                                              PID:1000
                                                          • C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe
                                                            "C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\
                                                            8⤵
                                                              PID:1984
                                                            • C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe
                                                              "C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
                                                              8⤵
                                                                PID:1204
                                                        • C:\Program Files\Internet Explorer\backup.exe
                                                          "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
                                                          5⤵
                                                          • Modifies visibility of file extensions in Explorer
                                                          • Disables RegEdit via registry modification
                                                          • Executes dropped EXE
                                                          • Drops file in Program Files directory
                                                          • Suspicious use of SetWindowsHookEx
                                                          PID:1924
                                                          • C:\Program Files\Internet Explorer\de-DE\backup.exe
                                                            "C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:1400
                                                          • C:\Program Files\Internet Explorer\en-US\backup.exe
                                                            "C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:1000
                                                          • C:\Program Files\Internet Explorer\es-ES\backup.exe
                                                            "C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Executes dropped EXE
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:1936
                                                          • C:\Program Files\Internet Explorer\fr-FR\backup.exe
                                                            "C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\
                                                            6⤵
                                                            • Modifies visibility of file extensions in Explorer
                                                            • Disables RegEdit via registry modification
                                                            • Suspicious use of SetWindowsHookEx
                                                            • System policy modification
                                                            PID:1304
                                                          • C:\Program Files\Internet Explorer\images\backup.exe
                                                            "C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\
                                                            6⤵
                                                              PID:940
                                                            • C:\Program Files\Internet Explorer\it-IT\backup.exe
                                                              "C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\
                                                              6⤵
                                                                PID:1540
                                                              • C:\Program Files\Internet Explorer\ja-JP\backup.exe
                                                                "C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\
                                                                6⤵
                                                                  PID:1672
                                                              • C:\Program Files\Java\backup.exe
                                                                "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                                                5⤵
                                                                • Modifies visibility of file extensions in Explorer
                                                                • Disables RegEdit via registry modification
                                                                • Executes dropped EXE
                                                                • Suspicious use of SetWindowsHookEx
                                                                • System policy modification
                                                                PID:1412
                                                                • C:\Program Files\Java\jdk1.7.0_80\backup.exe
                                                                  "C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\
                                                                  6⤵
                                                                    PID:1400
                                                                  • C:\Program Files\Java\jre7\backup.exe
                                                                    "C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\
                                                                    6⤵
                                                                      PID:884
                                                                  • C:\Program Files\Microsoft Games\backup.exe
                                                                    "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                                                    5⤵
                                                                      PID:544
                                                                    • C:\Program Files\Microsoft Office\backup.exe
                                                                      "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
                                                                      5⤵
                                                                        PID:1272
                                                                    • C:\Program Files (x86)\backup.exe
                                                                      "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                                                      4⤵
                                                                      • Modifies visibility of file extensions in Explorer
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      • System policy modification
                                                                      PID:1020
                                                                      • C:\Program Files (x86)\Adobe\backup.exe
                                                                        "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                                                        5⤵
                                                                        • Modifies visibility of file extensions in Explorer
                                                                        • Executes dropped EXE
                                                                        • Drops file in Program Files directory
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:1836
                                                                        • C:\Program Files (x86)\Adobe\Reader 9.0\data.exe
                                                                          "C:\Program Files (x86)\Adobe\Reader 9.0\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                                                          6⤵
                                                                          • Modifies visibility of file extensions in Explorer
                                                                          • Disables RegEdit via registry modification
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          • System policy modification
                                                                          PID:1740
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
                                                                            7⤵
                                                                            • Modifies visibility of file extensions in Explorer
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of SetWindowsHookEx
                                                                            PID:316
                                                                          • C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
                                                                            "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
                                                                            7⤵
                                                                              PID:1372
                                                                            • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
                                                                              "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
                                                                              7⤵
                                                                                PID:1544
                                                                              • C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
                                                                                "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
                                                                                7⤵
                                                                                  PID:1716
                                                                            • C:\Program Files (x86)\Common Files\backup.exe
                                                                              "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                                                              5⤵
                                                                                PID:1404
                                                                              • C:\Program Files (x86)\Google\backup.exe
                                                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                                                5⤵
                                                                                  PID:1304
                                                                              • C:\Users\backup.exe
                                                                                C:\Users\backup.exe C:\Users\
                                                                                4⤵
                                                                                • Modifies visibility of file extensions in Explorer
                                                                                • Disables RegEdit via registry modification
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of SetWindowsHookEx
                                                                                PID:1792
                                                                                • C:\Users\Admin\backup.exe
                                                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                                                  5⤵
                                                                                  • Modifies visibility of file extensions in Explorer
                                                                                  • Disables RegEdit via registry modification
                                                                                  • Executes dropped EXE
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  • System policy modification
                                                                                  PID:1488
                                                                                  • C:\Users\Admin\Contacts\backup.exe
                                                                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Disables RegEdit via registry modification
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:1728
                                                                                  • C:\Users\Admin\Desktop\backup.exe
                                                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                                                    6⤵
                                                                                    • Modifies visibility of file extensions in Explorer
                                                                                    • Executes dropped EXE
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    • System policy modification
                                                                                    PID:676
                                                                                  • C:\Users\Admin\Documents\backup.exe
                                                                                    C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                                                    6⤵
                                                                                      PID:1192
                                                                                    • C:\Users\Admin\Downloads\backup.exe
                                                                                      C:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\
                                                                                      6⤵
                                                                                        PID:1996
                                                                                      • C:\Users\Admin\Favorites\backup.exe
                                                                                        C:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\
                                                                                        6⤵
                                                                                          PID:2004
                                                                                      • C:\Users\Public\backup.exe
                                                                                        C:\Users\Public\backup.exe C:\Users\Public\
                                                                                        5⤵
                                                                                          PID:268
                                                                                      • C:\Windows\backup.exe
                                                                                        C:\Windows\backup.exe C:\Windows\
                                                                                        4⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:608
                                                                                        • C:\Windows\addins\data.exe
                                                                                          C:\Windows\addins\data.exe C:\Windows\addins\
                                                                                          5⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1664
                                                                                        • C:\Windows\AppCompat\backup.exe
                                                                                          C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
                                                                                          5⤵
                                                                                          • Modifies visibility of file extensions in Explorer
                                                                                          • Disables RegEdit via registry modification
                                                                                          • Executes dropped EXE
                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                          PID:1324
                                                                                        • C:\Windows\AppPatch\backup.exe
                                                                                          C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
                                                                                          5⤵
                                                                                            PID:396
                                                                                          • C:\Windows\assembly\backup.exe
                                                                                            C:\Windows\assembly\backup.exe C:\Windows\assembly\
                                                                                            5⤵
                                                                                              PID:1588
                                                                                      • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                                                        2⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1952
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                                                        2⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:1364
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                                                        2⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        PID:880
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                                                        2⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:616
                                                                                      • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                                                        2⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:1608
                                                                                      • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                                                        2⤵
                                                                                        • Modifies visibility of file extensions in Explorer
                                                                                        • Disables RegEdit via registry modification
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                        • System policy modification
                                                                                        PID:1372

                                                                                    Network

                                                                                    MITRE ATT&CK Enterprise v6

                                                                                    Replay Monitor

                                                                                    Loading Replay Monitor...

                                                                                    Downloads

                                                                                    • C:\PerfLogs\Admin\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • C:\PerfLogs\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • C:\PerfLogs\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • C:\Program Files\7-Zip\Lang\data.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      0afa7efb3829dc8ac266dd420a236e7d

                                                                                      SHA1

                                                                                      675701b8fdd3169eef173684198322b99062ec0a

                                                                                      SHA256

                                                                                      a7d206bead937df6295c3a6585dfecded41250d85c6b8ba87a13e92559e97eab

                                                                                      SHA512

                                                                                      6b189184d2cf00e7bb146729ed6f88a172474df74b55df2843ce3b21960d1d750eb5f33154f5fe6e37a5da3a2e3ecef26369731be0b1e63c5d53683164e5bd34

                                                                                      Download Submit

                                                                                    • C:\Program Files\7-Zip\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • C:\Program Files\7-Zip\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      966d8d4d6d7847f2fbb3ad4fe71dca67

                                                                                      SHA1

                                                                                      f022351888e188cae62d88df65412331ffc5751f

                                                                                      SHA256

                                                                                      9f2f725e7cc201d1e32eef6f42ee213266cb5a3d89c7b32053e5c1219910c7f7

                                                                                      SHA512

                                                                                      8a72c6e038b1113999275c3cd6c77335863aa81b918ca76520f86bbba25bd88031802feb610e64dd9ef905f504d2274ddb0cefbe5d2dfec5b7ac0a7b3e201a2f

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      966d8d4d6d7847f2fbb3ad4fe71dca67

                                                                                      SHA1

                                                                                      f022351888e188cae62d88df65412331ffc5751f

                                                                                      SHA256

                                                                                      9f2f725e7cc201d1e32eef6f42ee213266cb5a3d89c7b32053e5c1219910c7f7

                                                                                      SHA512

                                                                                      8a72c6e038b1113999275c3cd6c77335863aa81b918ca76520f86bbba25bd88031802feb610e64dd9ef905f504d2274ddb0cefbe5d2dfec5b7ac0a7b3e201a2f

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba7838a9a464c3a6c8254a88bd6bd7d3

                                                                                      SHA1

                                                                                      30d891ba2b4639bc68cfb6b5391ee6cf8d7f86b1

                                                                                      SHA256

                                                                                      e5f9f2fa6d28fc2ca5817a7626b3e38d2b19366aaf892629d2913c5ce0adcb58

                                                                                      SHA512

                                                                                      429c2a446e03bd907fd96879bee97cc8aa501b86d391f207d8f902eec5db24cb3d34a0d6f24f767dd22be41f3bb9bb9e05000db32fab4a8e32ffa5d773b85fc3

                                                                                      Download Submit

                                                                                    • C:\Program Files\Common Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba7838a9a464c3a6c8254a88bd6bd7d3

                                                                                      SHA1

                                                                                      30d891ba2b4639bc68cfb6b5391ee6cf8d7f86b1

                                                                                      SHA256

                                                                                      e5f9f2fa6d28fc2ca5817a7626b3e38d2b19366aaf892629d2913c5ce0adcb58

                                                                                      SHA512

                                                                                      429c2a446e03bd907fd96879bee97cc8aa501b86d391f207d8f902eec5db24cb3d34a0d6f24f767dd22be41f3bb9bb9e05000db32fab4a8e32ffa5d773b85fc3

                                                                                      Download Submit

                                                                                    • C:\Program Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • C:\Program Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\2303785755\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba08c6bde398a78545829493a54ad9bc

                                                                                      SHA1

                                                                                      a2c3e41ee11d7feb0379510cd22afa23fba4112d

                                                                                      SHA256

                                                                                      9cdca5a5eec13c7e502775495f751aa6c46ff9d49190043e4296a366f0c5f733

                                                                                      SHA512

                                                                                      f5480f42b25f02318299d0601e18a83bea178f148eb4894de7275d3bf359db432c89849c182cc4c5987ea93b2224c6ae098f5d4d295e86d63008d1c8e8de6dea

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\2303785755\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba08c6bde398a78545829493a54ad9bc

                                                                                      SHA1

                                                                                      a2c3e41ee11d7feb0379510cd22afa23fba4112d

                                                                                      SHA256

                                                                                      9cdca5a5eec13c7e502775495f751aa6c46ff9d49190043e4296a366f0c5f733

                                                                                      SHA512

                                                                                      f5480f42b25f02318299d0601e18a83bea178f148eb4894de7275d3bf359db432c89849c182cc4c5987ea93b2224c6ae098f5d4d295e86d63008d1c8e8de6dea

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      71604530bb3da7270802d376d6a34cb3

                                                                                      SHA1

                                                                                      9e13d29c68c37c1f92dd19b380d7d6030e32ae96

                                                                                      SHA256

                                                                                      7bfd193053054c537f91671dab53f9aad35f4675c57052473322359abb79c4c8

                                                                                      SHA512

                                                                                      ff8fb952544ad0875e43fe0cf36606bed1f5230fa70154f9897700edae9067e0fb986d9c750f75baa8e6a1289dffbf7343b2262eff42d65399aefdc81c7771e8

                                                                                      Download Submit

                                                                                    • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • C:\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      3ea9f25b2eae469db16eae8b893f5b0e

                                                                                      SHA1

                                                                                      b427a30763ba9e20b16a95bdcd1e6a302d972277

                                                                                      SHA256

                                                                                      c74eb83afb7d58b2ca5a71338db0b9d92a1e2f045ebff3d1195aec7835a16c0b

                                                                                      SHA512

                                                                                      f26b7b26d0881d754d080c3e75829bc2c72b5fa46152fd403f0a87ed92dd12ef13e3e5de3a98a9bb0194df2c98f377556ceeed3bca443ee373c195ddf6738549

                                                                                      Download Submit

                                                                                    • C:\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      3ea9f25b2eae469db16eae8b893f5b0e

                                                                                      SHA1

                                                                                      b427a30763ba9e20b16a95bdcd1e6a302d972277

                                                                                      SHA256

                                                                                      c74eb83afb7d58b2ca5a71338db0b9d92a1e2f045ebff3d1195aec7835a16c0b

                                                                                      SHA512

                                                                                      f26b7b26d0881d754d080c3e75829bc2c72b5fa46152fd403f0a87ed92dd12ef13e3e5de3a98a9bb0194df2c98f377556ceeed3bca443ee373c195ddf6738549

                                                                                      Download Submit

                                                                                    • \PerfLogs\Admin\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • \PerfLogs\Admin\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • \PerfLogs\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • \PerfLogs\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • \Program Files\7-Zip\Lang\data.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      0afa7efb3829dc8ac266dd420a236e7d

                                                                                      SHA1

                                                                                      675701b8fdd3169eef173684198322b99062ec0a

                                                                                      SHA256

                                                                                      a7d206bead937df6295c3a6585dfecded41250d85c6b8ba87a13e92559e97eab

                                                                                      SHA512

                                                                                      6b189184d2cf00e7bb146729ed6f88a172474df74b55df2843ce3b21960d1d750eb5f33154f5fe6e37a5da3a2e3ecef26369731be0b1e63c5d53683164e5bd34

                                                                                      Download Submit

                                                                                    • \Program Files\7-Zip\Lang\data.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      0afa7efb3829dc8ac266dd420a236e7d

                                                                                      SHA1

                                                                                      675701b8fdd3169eef173684198322b99062ec0a

                                                                                      SHA256

                                                                                      a7d206bead937df6295c3a6585dfecded41250d85c6b8ba87a13e92559e97eab

                                                                                      SHA512

                                                                                      6b189184d2cf00e7bb146729ed6f88a172474df74b55df2843ce3b21960d1d750eb5f33154f5fe6e37a5da3a2e3ecef26369731be0b1e63c5d53683164e5bd34

                                                                                      Download Submit

                                                                                    • \Program Files\7-Zip\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • \Program Files\7-Zip\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ef8b7da3e0e9c4fddd98aa50d6f76da2

                                                                                      SHA1

                                                                                      8ad1871f543b524d675adcf248633b3f7082f6b4

                                                                                      SHA256

                                                                                      cbd8d20e0772b84270d00b527c0fadbc113e27911d4f4a9bcd8e706dbdc799d8

                                                                                      SHA512

                                                                                      1c487f804af082435dbc3fdb3f79839cc9e10c3ced853545dc12489b037310564fb17e3dc70f4c5217c736041eea2ad5d0b3bc6ea33f215d6f045b13e99adb90

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      966d8d4d6d7847f2fbb3ad4fe71dca67

                                                                                      SHA1

                                                                                      f022351888e188cae62d88df65412331ffc5751f

                                                                                      SHA256

                                                                                      9f2f725e7cc201d1e32eef6f42ee213266cb5a3d89c7b32053e5c1219910c7f7

                                                                                      SHA512

                                                                                      8a72c6e038b1113999275c3cd6c77335863aa81b918ca76520f86bbba25bd88031802feb610e64dd9ef905f504d2274ddb0cefbe5d2dfec5b7ac0a7b3e201a2f

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      966d8d4d6d7847f2fbb3ad4fe71dca67

                                                                                      SHA1

                                                                                      f022351888e188cae62d88df65412331ffc5751f

                                                                                      SHA256

                                                                                      9f2f725e7cc201d1e32eef6f42ee213266cb5a3d89c7b32053e5c1219910c7f7

                                                                                      SHA512

                                                                                      8a72c6e038b1113999275c3cd6c77335863aa81b918ca76520f86bbba25bd88031802feb610e64dd9ef905f504d2274ddb0cefbe5d2dfec5b7ac0a7b3e201a2f

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\update.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b469335566827bc35b8ef1c87e71fe51

                                                                                      SHA1

                                                                                      0ed8b4d28b6bdd893013c1755c52faf49924ac70

                                                                                      SHA256

                                                                                      e8e0cd96e921420b8ebcd18a154309b42ffc1093d039927250f40d2d31cf720b

                                                                                      SHA512

                                                                                      da0c5a43275a93cc4ee268c83283ced07c07e878f9e2b65ba433e42b90bc023097b6d4a93527fc2d87e7ddb3317a1eea117339e0bdd39a2361d0e73590f17090

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      b42c7d996d65b440d4c4f1d8e2b27dd2

                                                                                      SHA1

                                                                                      4c322f70b295fbed84473597aaa71640c1602fc4

                                                                                      SHA256

                                                                                      3d56a0cf17f080594d808234a102318a653954f4290d4424d47a83263c2878e5

                                                                                      SHA512

                                                                                      981621465fd40c9cc9b9a2ced5af409cc0c69a2222fb2442b794b2ed8d68881be8be83a2c92906d82ee5fb7f5b294a74bacd46dca0c66cf3eb1f668d81df7fec

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba7838a9a464c3a6c8254a88bd6bd7d3

                                                                                      SHA1

                                                                                      30d891ba2b4639bc68cfb6b5391ee6cf8d7f86b1

                                                                                      SHA256

                                                                                      e5f9f2fa6d28fc2ca5817a7626b3e38d2b19366aaf892629d2913c5ce0adcb58

                                                                                      SHA512

                                                                                      429c2a446e03bd907fd96879bee97cc8aa501b86d391f207d8f902eec5db24cb3d34a0d6f24f767dd22be41f3bb9bb9e05000db32fab4a8e32ffa5d773b85fc3

                                                                                      Download Submit

                                                                                    • \Program Files\Common Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba7838a9a464c3a6c8254a88bd6bd7d3

                                                                                      SHA1

                                                                                      30d891ba2b4639bc68cfb6b5391ee6cf8d7f86b1

                                                                                      SHA256

                                                                                      e5f9f2fa6d28fc2ca5817a7626b3e38d2b19366aaf892629d2913c5ce0adcb58

                                                                                      SHA512

                                                                                      429c2a446e03bd907fd96879bee97cc8aa501b86d391f207d8f902eec5db24cb3d34a0d6f24f767dd22be41f3bb9bb9e05000db32fab4a8e32ffa5d773b85fc3

                                                                                      Download Submit

                                                                                    • \Program Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • \Program Files\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      bab5f305ab7a440e9fddb23622d88c0b

                                                                                      SHA1

                                                                                      c2e036becc60ac86bef11d23c7c963299ad4d1d6

                                                                                      SHA256

                                                                                      d49c05f50b72f7e9c5d6cfd53b4026cb5299498891e941bde76d4ecbb1d8ad79

                                                                                      SHA512

                                                                                      b3abec6a1c5387cac2f32352d610e67b9be6f3ad18bfa1f127af288169ccea0335ba0e64dec0fe43dd63351196b7f8522cdc60fdae1bfa8eeda5f0d52576ffa6

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\2303785755\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba08c6bde398a78545829493a54ad9bc

                                                                                      SHA1

                                                                                      a2c3e41ee11d7feb0379510cd22afa23fba4112d

                                                                                      SHA256

                                                                                      9cdca5a5eec13c7e502775495f751aa6c46ff9d49190043e4296a366f0c5f733

                                                                                      SHA512

                                                                                      f5480f42b25f02318299d0601e18a83bea178f148eb4894de7275d3bf359db432c89849c182cc4c5987ea93b2224c6ae098f5d4d295e86d63008d1c8e8de6dea

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\2303785755\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      ba08c6bde398a78545829493a54ad9bc

                                                                                      SHA1

                                                                                      a2c3e41ee11d7feb0379510cd22afa23fba4112d

                                                                                      SHA256

                                                                                      9cdca5a5eec13c7e502775495f751aa6c46ff9d49190043e4296a366f0c5f733

                                                                                      SHA512

                                                                                      f5480f42b25f02318299d0601e18a83bea178f148eb4894de7275d3bf359db432c89849c182cc4c5987ea93b2224c6ae098f5d4d295e86d63008d1c8e8de6dea

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      71604530bb3da7270802d376d6a34cb3

                                                                                      SHA1

                                                                                      9e13d29c68c37c1f92dd19b380d7d6030e32ae96

                                                                                      SHA256

                                                                                      7bfd193053054c537f91671dab53f9aad35f4675c57052473322359abb79c4c8

                                                                                      SHA512

                                                                                      ff8fb952544ad0875e43fe0cf36606bed1f5230fa70154f9897700edae9067e0fb986d9c750f75baa8e6a1289dffbf7343b2262eff42d65399aefdc81c7771e8

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      71604530bb3da7270802d376d6a34cb3

                                                                                      SHA1

                                                                                      9e13d29c68c37c1f92dd19b380d7d6030e32ae96

                                                                                      SHA256

                                                                                      7bfd193053054c537f91671dab53f9aad35f4675c57052473322359abb79c4c8

                                                                                      SHA512

                                                                                      ff8fb952544ad0875e43fe0cf36606bed1f5230fa70154f9897700edae9067e0fb986d9c750f75baa8e6a1289dffbf7343b2262eff42d65399aefdc81c7771e8

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
                                                                                      Filesize

                                                                                      72KB

                                                                                      MD5

                                                                                      e3c790640c04f886480f6f49e2275857

                                                                                      SHA1

                                                                                      22cbe0ad764f9b6882e479b1ba5edd6381a2746a

                                                                                      SHA256

                                                                                      102aea79db9c780e9aa3e300d26dd5696ac115de9d9b097f8fd1a1354d14dffd

                                                                                      SHA512

                                                                                      b1958c1202d32d9249115f3ddbe8713c0cf5d6da13500aa6d599267984b6bd3b5e3d318b8a8acd121960051ee2e80a839f29b7d62f8f686c8d218633d9970ec5

                                                                                      Download Submit

                                                                                    • memory/436-131-0x00000000740C1000-0x00000000740C3000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                      Download

                                                                                    • memory/436-98-0x0000000075831000-0x0000000075833000-memory.dmp

                                                                                      Filesize

                                                                                      8KB

                                                                                      Download