Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    109s
  • max time network
    32s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    03/12/2022, 16:49 UTC

General

  • Target

    b1e2dd800fec3e87e1bbf8e5ac15d91fc08c8703390dc614f9d7a254ea4a222e.exe

  • Size

    72KB

  • MD5

    073b775603a548c89e3bd5652ec939d5

  • SHA1

    b38f8f99a87ddad34778851de2c6edea3b29c4e4

  • SHA256

    b1e2dd800fec3e87e1bbf8e5ac15d91fc08c8703390dc614f9d7a254ea4a222e

  • SHA512

    88317bdc78139a914cf2ef224b306f7f9219139ae5e95395a63a3a3e46e5a593f5947990f1f62049875265f9f412fd38ff18345b10159bca2d5206da0b108979

  • SSDEEP

    384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2w:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPk

Score
10/10

Malware Config

Signatures

  • Modifies visibility of file extensions in Explorer 2 TTPs 41 IoCs
  • Disables RegEdit via registry modification 64 IoCs
  • Executes dropped EXE 48 IoCs
  • Loads dropped DLL 64 IoCs
  • Drops file in Program Files directory 37 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 44 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b1e2dd800fec3e87e1bbf8e5ac15d91fc08c8703390dc614f9d7a254ea4a222e.exe
    "C:\Users\Admin\AppData\Local\Temp\b1e2dd800fec3e87e1bbf8e5ac15d91fc08c8703390dc614f9d7a254ea4a222e.exe"
    1⤵
    • Modifies visibility of file extensions in Explorer
    • Disables RegEdit via registry modification
    • Loads dropped DLL
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1452
    • C:\Users\Admin\AppData\Local\Temp\3459915328\System Restore.exe
      "C:\Users\Admin\AppData\Local\Temp\3459915328\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\3459915328\
      2⤵
      • Modifies visibility of file extensions in Explorer
      • Disables RegEdit via registry modification
      • Executes dropped EXE
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2004
      • C:\backup.exe
        \backup.exe \
        3⤵
        • Modifies visibility of file extensions in Explorer
        • Disables RegEdit via registry modification
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:1120
        • C:\PerfLogs\backup.exe
          C:\PerfLogs\backup.exe C:\PerfLogs\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:1920
          • C:\PerfLogs\Admin\backup.exe
            C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Suspicious use of SetWindowsHookEx
            • System policy modification
            PID:1544
        • C:\Program Files\backup.exe
          "C:\Program Files\backup.exe" C:\Program Files\
          4⤵
          • Modifies visibility of file extensions in Explorer
          • Disables RegEdit via registry modification
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          • System policy modification
          PID:2016
          • C:\Program Files\7-Zip\backup.exe
            "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1828
            • C:\Program Files\7-Zip\Lang\backup.exe
              "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Disables RegEdit via registry modification
              • Executes dropped EXE
              • Suspicious use of SetWindowsHookEx
              • System policy modification
              PID:112
          • C:\Program Files\Common Files\backup.exe
            "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
            5⤵
            • Modifies visibility of file extensions in Explorer
            • Disables RegEdit via registry modification
            • Executes dropped EXE
            • Loads dropped DLL
            • Drops file in Program Files directory
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            • System policy modification
            PID:1904
            • C:\Program Files\Common Files\Microsoft Shared\backup.exe
              "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
              6⤵
              • Modifies visibility of file extensions in Explorer
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Program Files directory
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              • System policy modification
              PID:1972
              • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Suspicious use of SetWindowsHookEx
                PID:1348
              • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
                "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
                7⤵
                • Modifies visibility of file extensions in Explorer
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:1604
                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:2036
                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1768
                • C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:520
                • C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:560
                • C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1892
                • C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1548
                • C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
                  8⤵
                  • Modifies visibility of file extensions in Explorer
                  • Disables RegEdit via registry modification
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  • System policy modification
                  PID:1456
                • C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
                  8⤵
                  • Executes dropped EXE
                  • Suspicious use of SetWindowsHookEx
                  PID:316
                • C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
                  "C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
                  8⤵
                    PID:1196
                  • C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
                    8⤵
                      PID:1636
                  • C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
                    "C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
                    7⤵
                    • Modifies visibility of file extensions in Explorer
                    • Disables RegEdit via registry modification
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Drops file in Program Files directory
                    • Suspicious use of SetWindowsHookEx
                    • System policy modification
                    PID:608
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:808
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
                      8⤵
                      • Modifies visibility of file extensions in Explorer
                      • Disables RegEdit via registry modification
                      • Executes dropped EXE
                      • Suspicious use of SetWindowsHookEx
                      • System policy modification
                      PID:1744
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
                      8⤵
                      • Executes dropped EXE
                      PID:1568
                    • C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
                      "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
                      8⤵
                        PID:1352
                      • C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
                        8⤵
                          PID:1344
                      • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
                        7⤵
                        • Modifies visibility of file extensions in Explorer
                        • Disables RegEdit via registry modification
                        • Executes dropped EXE
                        • Drops file in Program Files directory
                        • Suspicious use of SetWindowsHookEx
                        PID:1656
                        • C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
                          8⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:2028
                      • C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
                        7⤵
                        • Executes dropped EXE
                        PID:1392
                      • C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe
                        "C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
                        7⤵
                          PID:1824
                        • C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
                          "C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
                          7⤵
                            PID:1140
                        • C:\Program Files\Common Files\Services\backup.exe
                          "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:892
                        • C:\Program Files\Common Files\SpeechEngines\backup.exe
                          "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          • System policy modification
                          PID:428
                          • C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
                            "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
                            7⤵
                            • Modifies visibility of file extensions in Explorer
                            • Disables RegEdit via registry modification
                            • Executes dropped EXE
                            • Drops file in Program Files directory
                            • Suspicious use of SetWindowsHookEx
                            • System policy modification
                            PID:1440
                        • C:\Program Files\Common Files\System\backup.exe
                          "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
                          6⤵
                          • Modifies visibility of file extensions in Explorer
                          • Disables RegEdit via registry modification
                          • Executes dropped EXE
                          • Drops file in Program Files directory
                          • Suspicious use of SetWindowsHookEx
                          PID:856
                          • C:\Program Files\Common Files\System\ado\System Restore.exe
                            "C:\Program Files\Common Files\System\ado\System Restore.exe" C:\Program Files\Common Files\System\ado\
                            7⤵
                            • Executes dropped EXE
                            PID:636
                            • C:\Program Files\Common Files\System\ado\de-DE\backup.exe
                              "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
                              8⤵
                                PID:1052
                              • C:\Program Files\Common Files\System\ado\en-US\backup.exe
                                "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
                                8⤵
                                  PID:1892
                              • C:\Program Files\Common Files\System\de-DE\backup.exe
                                "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
                                7⤵
                                  PID:1376
                                • C:\Program Files\Common Files\System\en-US\backup.exe
                                  "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
                                  7⤵
                                    PID:800
                              • C:\Program Files\DVD Maker\backup.exe
                                "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
                                5⤵
                                • Modifies visibility of file extensions in Explorer
                                • Disables RegEdit via registry modification
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • Suspicious use of SetWindowsHookEx
                                • System policy modification
                                PID:1508
                                • C:\Program Files\DVD Maker\de-DE\backup.exe
                                  "C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1808
                                • C:\Program Files\DVD Maker\en-US\backup.exe
                                  "C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
                                  6⤵
                                  • Modifies visibility of file extensions in Explorer
                                  • Disables RegEdit via registry modification
                                  • Executes dropped EXE
                                  • Suspicious use of SetWindowsHookEx
                                  • System policy modification
                                  PID:1760
                                • C:\Program Files\DVD Maker\es-ES\backup.exe
                                  "C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
                                  6⤵
                                  • Executes dropped EXE
                                  PID:1872
                                • C:\Program Files\DVD Maker\fr-FR\backup.exe
                                  "C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
                                  6⤵
                                    PID:1308
                                  • C:\Program Files\DVD Maker\it-IT\backup.exe
                                    "C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
                                    6⤵
                                      PID:1752
                                  • C:\Program Files\Google\backup.exe
                                    "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
                                    5⤵
                                    • Modifies visibility of file extensions in Explorer
                                    • Disables RegEdit via registry modification
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • Suspicious use of SetWindowsHookEx
                                    • System policy modification
                                    PID:800
                                    • C:\Program Files\Google\Chrome\backup.exe
                                      "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
                                      6⤵
                                      • Executes dropped EXE
                                      PID:1928
                                  • C:\Program Files\Internet Explorer\System Restore.exe
                                    "C:\Program Files\Internet Explorer\System Restore.exe" C:\Program Files\Internet Explorer\
                                    5⤵
                                      PID:1208
                                    • C:\Program Files\Java\backup.exe
                                      "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
                                      5⤵
                                        PID:384
                                      • C:\Program Files\Microsoft Games\backup.exe
                                        "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
                                        5⤵
                                          PID:1260
                                      • C:\Program Files (x86)\backup.exe
                                        "C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
                                        4⤵
                                        • Modifies visibility of file extensions in Explorer
                                        • Disables RegEdit via registry modification
                                        • Executes dropped EXE
                                        • Drops file in Program Files directory
                                        • Suspicious use of SetWindowsHookEx
                                        • System policy modification
                                        PID:672
                                        • C:\Program Files (x86)\Adobe\backup.exe
                                          "C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
                                          5⤵
                                          • Modifies visibility of file extensions in Explorer
                                          • Disables RegEdit via registry modification
                                          • Executes dropped EXE
                                          • Drops file in Program Files directory
                                          • Suspicious use of SetWindowsHookEx
                                          • System policy modification
                                          PID:1600
                                          • C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
                                            "C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
                                            6⤵
                                              PID:528
                                          • C:\Program Files (x86)\Common Files\backup.exe
                                            "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
                                            5⤵
                                              PID:1736
                                              • C:\Program Files (x86)\Common Files\Adobe\backup.exe
                                                "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
                                                6⤵
                                                  PID:480
                                              • C:\Program Files (x86)\Google\backup.exe
                                                "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
                                                5⤵
                                                  PID:1820
                                              • C:\Users\backup.exe
                                                C:\Users\backup.exe C:\Users\
                                                4⤵
                                                • Modifies visibility of file extensions in Explorer
                                                • Disables RegEdit via registry modification
                                                • Executes dropped EXE
                                                • Suspicious use of SetWindowsHookEx
                                                • System policy modification
                                                PID:1116
                                                • C:\Users\Admin\backup.exe
                                                  C:\Users\Admin\backup.exe C:\Users\Admin\
                                                  5⤵
                                                  • Modifies visibility of file extensions in Explorer
                                                  • Disables RegEdit via registry modification
                                                  • Executes dropped EXE
                                                  • Suspicious use of SetWindowsHookEx
                                                  • System policy modification
                                                  PID:1296
                                                  • C:\Users\Admin\Contacts\backup.exe
                                                    C:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\
                                                    6⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:1344
                                                  • C:\Users\Admin\Desktop\backup.exe
                                                    C:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\
                                                    6⤵
                                                      PID:112
                                                    • C:\Users\Admin\Documents\backup.exe
                                                      C:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\
                                                      6⤵
                                                        PID:924
                                                    • C:\Users\Public\backup.exe
                                                      C:\Users\Public\backup.exe C:\Users\Public\
                                                      5⤵
                                                        PID:1336
                                                    • C:\Windows\backup.exe
                                                      C:\Windows\backup.exe C:\Windows\
                                                      4⤵
                                                        PID:1516
                                                  • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
                                                    C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
                                                    2⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:568
                                                  • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
                                                    C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    PID:268
                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
                                                    2⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1712
                                                  • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
                                                    2⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1512
                                                  • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe
                                                    C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
                                                    2⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1300
                                                  • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
                                                    C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
                                                    2⤵
                                                    • Modifies visibility of file extensions in Explorer
                                                    • Disables RegEdit via registry modification
                                                    • Executes dropped EXE
                                                    • Suspicious use of SetWindowsHookEx
                                                    • System policy modification
                                                    PID:1704

                                                Network

                                                MITRE ATT&CK Enterprise v6

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\PerfLogs\Admin\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c62363caf5ce5c9fa22a29f22b8df85

                                                  SHA1

                                                  09ce7d250363a615a796fa6db7efea9c1f0e2aaa

                                                  SHA256

                                                  55b888da8efc0e2e80c4645e8e04e644b6faa8b5dda8d6d6f692c1ced76ee8f2

                                                  SHA512

                                                  76b701ec6052bd859f4a3b36bc5c865716dcfb5ec0f9e91d8f3beff2adddd06d5ce836b90620069d9176d3aa00f5a62ad27ef5870865dc02ab41cd23a58a790b

                                                • C:\PerfLogs\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • C:\PerfLogs\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • C:\Program Files\7-Zip\Lang\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  ba3e67e2aa1dc746f58454ce6f3908c8

                                                  SHA1

                                                  b72503ea4fcb88a8da6a5ddff38898b84bfc93b5

                                                  SHA256

                                                  e8a46d6b86150aba46690b083a21d2f41db988293380f8d14db2a965746ca70c

                                                  SHA512

                                                  f68a13df4a6101fa126f9ff8d5682daf555607f993d5b389613ec15bfab857d11e99f557f39f6bd7c76df682bc0c093217ba6285518984638968e4d77e4432d4

                                                • C:\Program Files\7-Zip\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  147c120bf9a5c41a516c9026d09fd168

                                                  SHA1

                                                  c60ff2eaf03d94884126149dc4167d90b74161f0

                                                  SHA256

                                                  9015823f4f974806ae016fe2fa87325d0dbc9e31deba9f9491b4e71a69db504b

                                                  SHA512

                                                  cadb8a4626913c75fee145c8e70db8067b4bcbdd453a99ffe863fed0ab2f57b6db91342c73a1252ebb2a8b0b4f9a09147b78fc90a0b2f0ee076d238fe362f677

                                                • C:\Program Files\7-Zip\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  147c120bf9a5c41a516c9026d09fd168

                                                  SHA1

                                                  c60ff2eaf03d94884126149dc4167d90b74161f0

                                                  SHA256

                                                  9015823f4f974806ae016fe2fa87325d0dbc9e31deba9f9491b4e71a69db504b

                                                  SHA512

                                                  cadb8a4626913c75fee145c8e70db8067b4bcbdd453a99ffe863fed0ab2f57b6db91342c73a1252ebb2a8b0b4f9a09147b78fc90a0b2f0ee076d238fe362f677

                                                • C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b601d50ff67c8a461eb6b40d164f8df4

                                                  SHA1

                                                  3b3056833b677d9d385bb60af579e781bf9a0136

                                                  SHA256

                                                  288f0afdabfb5815e237e8580c3f08c6e7d095cb3623f9e9207ea710203573d4

                                                  SHA512

                                                  a1a824e7af8f6cc04da6f5e9dab5d6912498e4fac2c6d416caa15649da841f239a517a1e07cb11e56b5fe42766f02568e6fe710c21a99174ef2d93107842a21c

                                                • C:\Program Files\Common Files\Microsoft Shared\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b601d50ff67c8a461eb6b40d164f8df4

                                                  SHA1

                                                  3b3056833b677d9d385bb60af579e781bf9a0136

                                                  SHA256

                                                  288f0afdabfb5815e237e8580c3f08c6e7d095cb3623f9e9207ea710203573d4

                                                  SHA512

                                                  a1a824e7af8f6cc04da6f5e9dab5d6912498e4fac2c6d416caa15649da841f239a517a1e07cb11e56b5fe42766f02568e6fe710c21a99174ef2d93107842a21c

                                                • C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  111998152e4d1d9c672d539bb298b7a8

                                                  SHA1

                                                  679bd5689afae2bec3a3163801c12a178e54018c

                                                  SHA256

                                                  88d890f07b2c30699f676939f51316a4c2c076958b0b3fad79c63abd8712bd81

                                                  SHA512

                                                  57e78a69f1c43472bf93b203bc259c5af347f5f0ef34c7f6bc96bb9742ae9979556a0d4b7a1e033822cf8dd002232913e22c09551a0864586e293285e99aba1d

                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b9c28d36a57433ba216484a47f4a7b6a

                                                  SHA1

                                                  7fbbeafe0e140ab91f0a7343fa520b8ea21e05b0

                                                  SHA256

                                                  a49040900774062b0330a9c759caa2c9050686bc2683e0a2303bcc098624ded9

                                                  SHA512

                                                  5ba66dc4032829b68de7ed1ee3497576194d57c62a50b39cae30214d42ce7d1f81d5bb438d4c9715167d6c672ee1327815fe62fbba83538cdd65fbf58b4f5317

                                                • C:\Program Files\Common Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  501860f53c4d9b5cc70e50f95f1c5da4

                                                  SHA1

                                                  3f31fa4eab130e8cc54451dd9febb73c9198dbb6

                                                  SHA256

                                                  1c611f3a271eba454115b4191b4e716bbc74b1b41b379ad76bcbb54f4e856322

                                                  SHA512

                                                  9009021be30966163b1a23bcc3246f62c9b2dc4266b82b799c04545fce4e51d34343f284fcd03afca8ba00cad7c91626aadb2a75db1889fc047b3dcf20c7515d

                                                • C:\Program Files\Common Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  501860f53c4d9b5cc70e50f95f1c5da4

                                                  SHA1

                                                  3f31fa4eab130e8cc54451dd9febb73c9198dbb6

                                                  SHA256

                                                  1c611f3a271eba454115b4191b4e716bbc74b1b41b379ad76bcbb54f4e856322

                                                  SHA512

                                                  9009021be30966163b1a23bcc3246f62c9b2dc4266b82b799c04545fce4e51d34343f284fcd03afca8ba00cad7c91626aadb2a75db1889fc047b3dcf20c7515d

                                                • C:\Program Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • C:\Program Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • C:\Users\Admin\AppData\Local\Temp\3459915328\System Restore.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b41d4a37163f0fe6e1df011b63e299b7

                                                  SHA1

                                                  d672c277d39fc4a37092ac71919a9a3ab596c445

                                                  SHA256

                                                  9310e75fe0a464d92a9063b7b988007eb662bf9c3c203b6dba0c4ae76704d6f3

                                                  SHA512

                                                  92328e28dd465fe634412d06534ca7102b41b662ce0ecbabc56fe452d02e163e9762c2c612eeb80adfef20ae834928b381315a7c92b0f08144a81b0d5e93a106

                                                • C:\Users\Admin\AppData\Local\Temp\3459915328\System Restore.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b41d4a37163f0fe6e1df011b63e299b7

                                                  SHA1

                                                  d672c277d39fc4a37092ac71919a9a3ab596c445

                                                  SHA256

                                                  9310e75fe0a464d92a9063b7b988007eb662bf9c3c203b6dba0c4ae76704d6f3

                                                  SHA512

                                                  92328e28dd465fe634412d06534ca7102b41b662ce0ecbabc56fe452d02e163e9762c2c612eeb80adfef20ae834928b381315a7c92b0f08144a81b0d5e93a106

                                                • C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fbd80bbc5d9e0968a0105f0056d81990

                                                  SHA1

                                                  bc89b636770b62db832c7b993479a64bfe430a8c

                                                  SHA256

                                                  f2208dd9dbc42cccb730073fb3682a481e2323b58e46d94cf1d0c9be13671d92

                                                  SHA512

                                                  ea8a383fa07151b4ff58ece93e3c8d42cfd63e86bfa4146d51fbf9dbaa7c1e5fd7d6f45db5683945c47d3d20d69a35a613c6f4efbbc054a9ca3eb419351f98d9

                                                • C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  55ab4f179c67906a8f66b041a18dbb09

                                                  SHA1

                                                  23d869f78eb944f81d09ff1ad25151774488813d

                                                  SHA256

                                                  0a105146fd200842e7162a913227bbd38eb75f477f24765b5ab6b3395f2cd3c7

                                                  SHA512

                                                  e475c4244f89a5ed287519a0874b6e84b9741b32f882a897b471075f038b981afc1667d1ca5d02cd2d977033bae4351732ab05beeb3d0fc9714e3c8fa02ef89b

                                                • C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fbd80bbc5d9e0968a0105f0056d81990

                                                  SHA1

                                                  bc89b636770b62db832c7b993479a64bfe430a8c

                                                  SHA256

                                                  f2208dd9dbc42cccb730073fb3682a481e2323b58e46d94cf1d0c9be13671d92

                                                  SHA512

                                                  ea8a383fa07151b4ff58ece93e3c8d42cfd63e86bfa4146d51fbf9dbaa7c1e5fd7d6f45db5683945c47d3d20d69a35a613c6f4efbbc054a9ca3eb419351f98d9

                                                • C:\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  6c9fd88e393932d53c46dd49147a5517

                                                  SHA1

                                                  6725243f6c8aa0e9087a1f1f2982ae86385f2e3b

                                                  SHA256

                                                  c8c3134ee2b321fb092fd5a2496491ccc45f2fb85e4690005f339af4e5811e37

                                                  SHA512

                                                  aa24edca765da2d853f2a4f8aef41f8abeaca37a4192c99cf0cb2e1a414d4b00a08360b2fa2ee104e2d97eebf7520a25b355194cb8d53ffc15ebe8b8b099ec12

                                                • C:\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  6c9fd88e393932d53c46dd49147a5517

                                                  SHA1

                                                  6725243f6c8aa0e9087a1f1f2982ae86385f2e3b

                                                  SHA256

                                                  c8c3134ee2b321fb092fd5a2496491ccc45f2fb85e4690005f339af4e5811e37

                                                  SHA512

                                                  aa24edca765da2d853f2a4f8aef41f8abeaca37a4192c99cf0cb2e1a414d4b00a08360b2fa2ee104e2d97eebf7520a25b355194cb8d53ffc15ebe8b8b099ec12

                                                • \PerfLogs\Admin\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c62363caf5ce5c9fa22a29f22b8df85

                                                  SHA1

                                                  09ce7d250363a615a796fa6db7efea9c1f0e2aaa

                                                  SHA256

                                                  55b888da8efc0e2e80c4645e8e04e644b6faa8b5dda8d6d6f692c1ced76ee8f2

                                                  SHA512

                                                  76b701ec6052bd859f4a3b36bc5c865716dcfb5ec0f9e91d8f3beff2adddd06d5ce836b90620069d9176d3aa00f5a62ad27ef5870865dc02ab41cd23a58a790b

                                                • \PerfLogs\Admin\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  9c62363caf5ce5c9fa22a29f22b8df85

                                                  SHA1

                                                  09ce7d250363a615a796fa6db7efea9c1f0e2aaa

                                                  SHA256

                                                  55b888da8efc0e2e80c4645e8e04e644b6faa8b5dda8d6d6f692c1ced76ee8f2

                                                  SHA512

                                                  76b701ec6052bd859f4a3b36bc5c865716dcfb5ec0f9e91d8f3beff2adddd06d5ce836b90620069d9176d3aa00f5a62ad27ef5870865dc02ab41cd23a58a790b

                                                • \PerfLogs\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • \PerfLogs\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • \Program Files\7-Zip\Lang\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  ba3e67e2aa1dc746f58454ce6f3908c8

                                                  SHA1

                                                  b72503ea4fcb88a8da6a5ddff38898b84bfc93b5

                                                  SHA256

                                                  e8a46d6b86150aba46690b083a21d2f41db988293380f8d14db2a965746ca70c

                                                  SHA512

                                                  f68a13df4a6101fa126f9ff8d5682daf555607f993d5b389613ec15bfab857d11e99f557f39f6bd7c76df682bc0c093217ba6285518984638968e4d77e4432d4

                                                • \Program Files\7-Zip\Lang\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  ba3e67e2aa1dc746f58454ce6f3908c8

                                                  SHA1

                                                  b72503ea4fcb88a8da6a5ddff38898b84bfc93b5

                                                  SHA256

                                                  e8a46d6b86150aba46690b083a21d2f41db988293380f8d14db2a965746ca70c

                                                  SHA512

                                                  f68a13df4a6101fa126f9ff8d5682daf555607f993d5b389613ec15bfab857d11e99f557f39f6bd7c76df682bc0c093217ba6285518984638968e4d77e4432d4

                                                • \Program Files\7-Zip\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  147c120bf9a5c41a516c9026d09fd168

                                                  SHA1

                                                  c60ff2eaf03d94884126149dc4167d90b74161f0

                                                  SHA256

                                                  9015823f4f974806ae016fe2fa87325d0dbc9e31deba9f9491b4e71a69db504b

                                                  SHA512

                                                  cadb8a4626913c75fee145c8e70db8067b4bcbdd453a99ffe863fed0ab2f57b6db91342c73a1252ebb2a8b0b4f9a09147b78fc90a0b2f0ee076d238fe362f677

                                                • \Program Files\7-Zip\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  147c120bf9a5c41a516c9026d09fd168

                                                  SHA1

                                                  c60ff2eaf03d94884126149dc4167d90b74161f0

                                                  SHA256

                                                  9015823f4f974806ae016fe2fa87325d0dbc9e31deba9f9491b4e71a69db504b

                                                  SHA512

                                                  cadb8a4626913c75fee145c8e70db8067b4bcbdd453a99ffe863fed0ab2f57b6db91342c73a1252ebb2a8b0b4f9a09147b78fc90a0b2f0ee076d238fe362f677

                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • \Program Files\Common Files\Microsoft Shared\Filters\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b601d50ff67c8a461eb6b40d164f8df4

                                                  SHA1

                                                  3b3056833b677d9d385bb60af579e781bf9a0136

                                                  SHA256

                                                  288f0afdabfb5815e237e8580c3f08c6e7d095cb3623f9e9207ea710203573d4

                                                  SHA512

                                                  a1a824e7af8f6cc04da6f5e9dab5d6912498e4fac2c6d416caa15649da841f239a517a1e07cb11e56b5fe42766f02568e6fe710c21a99174ef2d93107842a21c

                                                • \Program Files\Common Files\Microsoft Shared\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b601d50ff67c8a461eb6b40d164f8df4

                                                  SHA1

                                                  3b3056833b677d9d385bb60af579e781bf9a0136

                                                  SHA256

                                                  288f0afdabfb5815e237e8580c3f08c6e7d095cb3623f9e9207ea710203573d4

                                                  SHA512

                                                  a1a824e7af8f6cc04da6f5e9dab5d6912498e4fac2c6d416caa15649da841f239a517a1e07cb11e56b5fe42766f02568e6fe710c21a99174ef2d93107842a21c

                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  111998152e4d1d9c672d539bb298b7a8

                                                  SHA1

                                                  679bd5689afae2bec3a3163801c12a178e54018c

                                                  SHA256

                                                  88d890f07b2c30699f676939f51316a4c2c076958b0b3fad79c63abd8712bd81

                                                  SHA512

                                                  57e78a69f1c43472bf93b203bc259c5af347f5f0ef34c7f6bc96bb9742ae9979556a0d4b7a1e033822cf8dd002232913e22c09551a0864586e293285e99aba1d

                                                • \Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  111998152e4d1d9c672d539bb298b7a8

                                                  SHA1

                                                  679bd5689afae2bec3a3163801c12a178e54018c

                                                  SHA256

                                                  88d890f07b2c30699f676939f51316a4c2c076958b0b3fad79c63abd8712bd81

                                                  SHA512

                                                  57e78a69f1c43472bf93b203bc259c5af347f5f0ef34c7f6bc96bb9742ae9979556a0d4b7a1e033822cf8dd002232913e22c09551a0864586e293285e99aba1d

                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • \Program Files\Common Files\Microsoft Shared\ink\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  5e9a3cb81518ce475e393cccfd5e2445

                                                  SHA1

                                                  c968b4a6854317a6eb22cbe44c4c063eda4b7562

                                                  SHA256

                                                  b919761d797964f9c74497ae3cee085c00a573925152783467a25f2a073e86a9

                                                  SHA512

                                                  d5473e5598caa448c82f458fddc893226915282e93cfb2136a6cf2a1bd1bad7c869b004d209644d9e69e83b58133fdd0189fe47233dc7b55c33d7ed8344c906f

                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b9c28d36a57433ba216484a47f4a7b6a

                                                  SHA1

                                                  7fbbeafe0e140ab91f0a7343fa520b8ea21e05b0

                                                  SHA256

                                                  a49040900774062b0330a9c759caa2c9050686bc2683e0a2303bcc098624ded9

                                                  SHA512

                                                  5ba66dc4032829b68de7ed1ee3497576194d57c62a50b39cae30214d42ce7d1f81d5bb438d4c9715167d6c672ee1327815fe62fbba83538cdd65fbf58b4f5317

                                                • \Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b9c28d36a57433ba216484a47f4a7b6a

                                                  SHA1

                                                  7fbbeafe0e140ab91f0a7343fa520b8ea21e05b0

                                                  SHA256

                                                  a49040900774062b0330a9c759caa2c9050686bc2683e0a2303bcc098624ded9

                                                  SHA512

                                                  5ba66dc4032829b68de7ed1ee3497576194d57c62a50b39cae30214d42ce7d1f81d5bb438d4c9715167d6c672ee1327815fe62fbba83538cdd65fbf58b4f5317

                                                • \Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b9c28d36a57433ba216484a47f4a7b6a

                                                  SHA1

                                                  7fbbeafe0e140ab91f0a7343fa520b8ea21e05b0

                                                  SHA256

                                                  a49040900774062b0330a9c759caa2c9050686bc2683e0a2303bcc098624ded9

                                                  SHA512

                                                  5ba66dc4032829b68de7ed1ee3497576194d57c62a50b39cae30214d42ce7d1f81d5bb438d4c9715167d6c672ee1327815fe62fbba83538cdd65fbf58b4f5317

                                                • \Program Files\Common Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  501860f53c4d9b5cc70e50f95f1c5da4

                                                  SHA1

                                                  3f31fa4eab130e8cc54451dd9febb73c9198dbb6

                                                  SHA256

                                                  1c611f3a271eba454115b4191b4e716bbc74b1b41b379ad76bcbb54f4e856322

                                                  SHA512

                                                  9009021be30966163b1a23bcc3246f62c9b2dc4266b82b799c04545fce4e51d34343f284fcd03afca8ba00cad7c91626aadb2a75db1889fc047b3dcf20c7515d

                                                • \Program Files\Common Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  501860f53c4d9b5cc70e50f95f1c5da4

                                                  SHA1

                                                  3f31fa4eab130e8cc54451dd9febb73c9198dbb6

                                                  SHA256

                                                  1c611f3a271eba454115b4191b4e716bbc74b1b41b379ad76bcbb54f4e856322

                                                  SHA512

                                                  9009021be30966163b1a23bcc3246f62c9b2dc4266b82b799c04545fce4e51d34343f284fcd03afca8ba00cad7c91626aadb2a75db1889fc047b3dcf20c7515d

                                                • \Program Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • \Program Files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  e4caf2b63aa34908c05ab0f2798ce743

                                                  SHA1

                                                  50ef0bf27f9f08bc55ab247659bc58ce94ec60fe

                                                  SHA256

                                                  bf3e7f6fd43856854c01829078010858d326ae39300e56e2a55eaf2d0581b5ea

                                                  SHA512

                                                  0bacb2520596f03844f3c6e810f9a5f6e8d2009ce6dfff9e59b4ecb90599976e19bc8da610413aadf36d1d82f6bb0227122fe244ddb855f7f3dd044aa1edae56

                                                • \Users\Admin\AppData\Local\Temp\3459915328\System Restore.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b41d4a37163f0fe6e1df011b63e299b7

                                                  SHA1

                                                  d672c277d39fc4a37092ac71919a9a3ab596c445

                                                  SHA256

                                                  9310e75fe0a464d92a9063b7b988007eb662bf9c3c203b6dba0c4ae76704d6f3

                                                  SHA512

                                                  92328e28dd465fe634412d06534ca7102b41b662ce0ecbabc56fe452d02e163e9762c2c612eeb80adfef20ae834928b381315a7c92b0f08144a81b0d5e93a106

                                                • \Users\Admin\AppData\Local\Temp\3459915328\System Restore.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  b41d4a37163f0fe6e1df011b63e299b7

                                                  SHA1

                                                  d672c277d39fc4a37092ac71919a9a3ab596c445

                                                  SHA256

                                                  9310e75fe0a464d92a9063b7b988007eb662bf9c3c203b6dba0c4ae76704d6f3

                                                  SHA512

                                                  92328e28dd465fe634412d06534ca7102b41b662ce0ecbabc56fe452d02e163e9762c2c612eeb80adfef20ae834928b381315a7c92b0f08144a81b0d5e93a106

                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • \Users\Admin\AppData\Local\Temp\Low\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • \Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  cee743cd4e36b8ece5af2ffb00053407

                                                  SHA1

                                                  0fb8ccbd1d3e5bcd3502615520df808cd13b8136

                                                  SHA256

                                                  82a3a5a145d9531f89d89bf2da4f92702edf10e51ddc3966d6e06a292ed8af6c

                                                  SHA512

                                                  d8bd76afe62e4b178810c78ab414faf89bc3c9f8764b08a37c5927e28c695adfa47da7e5b926b5be452430546342975a47876392dffc991c4de385c62a0d13ba

                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fbd80bbc5d9e0968a0105f0056d81990

                                                  SHA1

                                                  bc89b636770b62db832c7b993479a64bfe430a8c

                                                  SHA256

                                                  f2208dd9dbc42cccb730073fb3682a481e2323b58e46d94cf1d0c9be13671d92

                                                  SHA512

                                                  ea8a383fa07151b4ff58ece93e3c8d42cfd63e86bfa4146d51fbf9dbaa7c1e5fd7d6f45db5683945c47d3d20d69a35a613c6f4efbbc054a9ca3eb419351f98d9

                                                • \Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fbd80bbc5d9e0968a0105f0056d81990

                                                  SHA1

                                                  bc89b636770b62db832c7b993479a64bfe430a8c

                                                  SHA256

                                                  f2208dd9dbc42cccb730073fb3682a481e2323b58e46d94cf1d0c9be13671d92

                                                  SHA512

                                                  ea8a383fa07151b4ff58ece93e3c8d42cfd63e86bfa4146d51fbf9dbaa7c1e5fd7d6f45db5683945c47d3d20d69a35a613c6f4efbbc054a9ca3eb419351f98d9

                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  55ab4f179c67906a8f66b041a18dbb09

                                                  SHA1

                                                  23d869f78eb944f81d09ff1ad25151774488813d

                                                  SHA256

                                                  0a105146fd200842e7162a913227bbd38eb75f477f24765b5ab6b3395f2cd3c7

                                                  SHA512

                                                  e475c4244f89a5ed287519a0874b6e84b9741b32f882a897b471075f038b981afc1667d1ca5d02cd2d977033bae4351732ab05beeb3d0fc9714e3c8fa02ef89b

                                                • \Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  55ab4f179c67906a8f66b041a18dbb09

                                                  SHA1

                                                  23d869f78eb944f81d09ff1ad25151774488813d

                                                  SHA256

                                                  0a105146fd200842e7162a913227bbd38eb75f477f24765b5ab6b3395f2cd3c7

                                                  SHA512

                                                  e475c4244f89a5ed287519a0874b6e84b9741b32f882a897b471075f038b981afc1667d1ca5d02cd2d977033bae4351732ab05beeb3d0fc9714e3c8fa02ef89b

                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fbd80bbc5d9e0968a0105f0056d81990

                                                  SHA1

                                                  bc89b636770b62db832c7b993479a64bfe430a8c

                                                  SHA256

                                                  f2208dd9dbc42cccb730073fb3682a481e2323b58e46d94cf1d0c9be13671d92

                                                  SHA512

                                                  ea8a383fa07151b4ff58ece93e3c8d42cfd63e86bfa4146d51fbf9dbaa7c1e5fd7d6f45db5683945c47d3d20d69a35a613c6f4efbbc054a9ca3eb419351f98d9

                                                • \Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe

                                                  Filesize

                                                  72KB

                                                  MD5

                                                  fbd80bbc5d9e0968a0105f0056d81990

                                                  SHA1

                                                  bc89b636770b62db832c7b993479a64bfe430a8c

                                                  SHA256

                                                  f2208dd9dbc42cccb730073fb3682a481e2323b58e46d94cf1d0c9be13671d92

                                                  SHA512

                                                  ea8a383fa07151b4ff58ece93e3c8d42cfd63e86bfa4146d51fbf9dbaa7c1e5fd7d6f45db5683945c47d3d20d69a35a613c6f4efbbc054a9ca3eb419351f98d9

                                                • memory/1452-199-0x0000000074B31000-0x0000000074B33000-memory.dmp

                                                  Filesize

                                                  8KB

                                                • memory/1452-121-0x0000000076941000-0x0000000076943000-memory.dmp

                                                  Filesize

                                                  8KB

                                                We care about your privacy.

                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.