8a6d184324bba2db03b34a146b68d00e91801e508a679ef6813ccd0a9c528136

Analysis

max time kernel
3s
max time network
141s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c94ee47debd742ce1400f04916730070.exe
Size

84KB
MD5

c94ee47debd742ce1400f04916730070
SHA1

8ad1ab91b31d5af3f877f16b34df7746586ee6df
SHA256

8a6d184324bba2db03b34a146b68d00e91801e508a679ef6813ccd0a9c528136
SHA512

cee8ddf3e4e25263fadf163a0fa54aa4a9c90a692e1503334ac13602bd4037d224f94aa64c8710d314c4fcb270bbee24e8d5656d6037208488550d3be6d6bc90
SSDEEP

768:/pQNwC3BESe4Vqth+0V5vKmyLylze70wi3BEml:BeT7BVwxfvEFwjRl

Score

10^/10

evasion upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 7 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	NEAS.c94ee47debd742ce1400f04916730070.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	backup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1154728922-3261336865-3456416385-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	data.exe

Executes dropped EXE 7 IoCs

pid	Process
2104	backup.exe
2692	backup.exe
2820	backup.exe
2140	backup.exe
2804	backup.exe
1740	data.exe
3032	backup.exe

Loads dropped DLL 14 IoCs

pid	Process
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2096	NEAS.c94ee47debd742ce1400f04916730070.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2096-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0007000000016454-5.dat	upx
behavioral1/files/0x0007000000016454-9.dat	upx
behavioral1/files/0x0007000000016454-11.dat	upx
behavioral1/files/0x0007000000016454-7.dat	upx
behavioral1/files/0x0007000000016619-15.dat	upx
behavioral1/files/0x0007000000016619-22.dat	upx
behavioral1/memory/2692-23-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0007000000016619-17.dat	upx
behavioral1/files/0x0008000000016baa-28.dat	upx
behavioral1/memory/2692-27-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0008000000016baa-34.dat	upx
behavioral1/files/0x00080000000167f7-38.dat	upx
behavioral1/memory/2096-45-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0006000000016ce0-70.dat	upx
behavioral1/memory/3032-87-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0006000000016ce8-82.dat	upx
behavioral1/files/0x0006000000016ce8-78.dat	upx
behavioral1/memory/2820-77-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1740-76-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0006000000016ce8-74.dat	upx
behavioral1/files/0x0006000000016ce0-66.dat	upx
behavioral1/files/0x000b000000016ca4-109.dat	upx
behavioral1/files/0x0006000000016d38-140.dat	upx
behavioral1/files/0x0007000000016d28-161.dat	upx
behavioral1/memory/664-162-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0007000000016d6e-187.dat	upx
behavioral1/files/0x0006000000016d78-195.dat	upx
behavioral1/files/0x0006000000016d78-203.dat	upx
behavioral1/files/0x0006000000016d78-200.dat	upx
behavioral1/files/0x0006000000016d85-212.dat	upx
behavioral1/files/0x0006000000016d85-208.dat	upx
behavioral1/files/0x0006000000016d85-205.dat	upx
behavioral1/files/0x0006000000016fe8-219.dat	upx
behavioral1/files/0x0006000000016fe8-223.dat	upx
behavioral1/memory/2968-217-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0006000000016fe8-228.dat	upx
behavioral1/files/0x0006000000017101-237.dat	upx
behavioral1/memory/320-236-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0006000000017101-232.dat	upx
behavioral1/files/0x0006000000017101-230.dat	upx
behavioral1/memory/2016-253-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x000600000001756a-248.dat	upx
behavioral1/files/0x000600000001756a-244.dat	upx
behavioral1/memory/1188-255-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0005000000018698-256.dat	upx
behavioral1/memory/1680-263-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/896-281-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1480-305-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2940-320-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2708-339-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2568-374-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2764-379-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3028-383-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2140-365-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2816-356-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1596-329-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/756-313-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/840-296-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/824-272-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1152-243-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x000600000001756a-241.dat	upx
behavioral1/files/0x0006000000016fe8-216.dat	upx
behavioral1/memory/112-194-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2096	NEAS.c94ee47debd742ce1400f04916730070.exe
2104	backup.exe
2692	backup.exe
2820	backup.exe
2140	backup.exe
2804	backup.exe
1740	data.exe
3032	backup.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 2104	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	28
PID 2096 wrote to memory of 2104	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	28
PID 2096 wrote to memory of 2104	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	28
PID 2096 wrote to memory of 2104	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	28
PID 2096 wrote to memory of 2692	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	29
PID 2096 wrote to memory of 2692	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	29
PID 2096 wrote to memory of 2692	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	29
PID 2096 wrote to memory of 2692	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	29
PID 2096 wrote to memory of 2820	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	227
PID 2096 wrote to memory of 2820	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	227
PID 2096 wrote to memory of 2820	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	227
PID 2096 wrote to memory of 2820	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	227
PID 2096 wrote to memory of 2140	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	226
PID 2096 wrote to memory of 2140	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	226
PID 2096 wrote to memory of 2140	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	226
PID 2096 wrote to memory of 2140	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	226
PID 2096 wrote to memory of 2804	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	225
PID 2096 wrote to memory of 2804	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	225
PID 2096 wrote to memory of 2804	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	225
PID 2096 wrote to memory of 2804	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	225
PID 2096 wrote to memory of 1740	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	224
PID 2096 wrote to memory of 1740	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	224
PID 2096 wrote to memory of 1740	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	224
PID 2096 wrote to memory of 1740	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	224
PID 2096 wrote to memory of 3032	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	30
PID 2096 wrote to memory of 3032	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	30
PID 2096 wrote to memory of 3032	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	30
PID 2096 wrote to memory of 3032	2096	NEAS.c94ee47debd742ce1400f04916730070.exe	30

System policy modification 1 TTPs 14 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NEAS.c94ee47debd742ce1400f04916730070.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	data.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	NEAS.c94ee47debd742ce1400f04916730070.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	backup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1"	backup.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.c94ee47debd742ce1400f04916730070.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c94ee47debd742ce1400f04916730070.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2096
- C:\Users\Admin\AppData\Local\Temp\3213833178\backup.exe
  C:\Users\Admin\AppData\Local\Temp\3213833178\backup.exe C:\Users\Admin\AppData\Local\Temp\3213833178\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2104
- - C:\backup.exe
    \backup.exe \
    3⤵
    PID:664
  - - C:\Users\System Restore.exe
      "C:\Users\System Restore.exe" C:\Users\
      4⤵
      PID:2260
    - - C:\Users\Admin\backup.exe
        
        C:\Users\Admin\backup.exe C:\Users\Admin\
        5⤵
        
        PID:1884
    - - C:\Users\Public\backup.exe
        
        C:\Users\Public\backup.exe C:\Users\Public\
        5⤵
        
        PID:1960
  - - C:\Windows\backup.exe
      C:\Windows\backup.exe C:\Windows\
      4⤵
      PID:2444
    - - C:\Windows\addins\backup.exe
        
        C:\Windows\addins\backup.exe C:\Windows\addins\
        5⤵
        
        PID:328
    - - C:\Windows\AppCompat\backup.exe
        
        C:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\
        5⤵
        
        PID:1632
    - - C:\Windows\AppPatch\backup.exe
        
        C:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\
        5⤵
        
        PID:2016
- C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe
  C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2692
- C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe
  C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe
  C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2804
- C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
  "C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - System policy modification
  PID:2140
- C:\Users\Admin\AppData\Local\Temp\Low\backup.exe
  C:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2820

C:\Program Files\backup.exe
"C:\Program Files\backup.exe" C:\Program Files\
1⤵
PID:112
- C:\Program Files\Common Files\backup.exe
  "C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\
  2⤵
  PID:320
- - C:\Program Files\Common Files\SpeechEngines\backup.exe
    "C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\
    3⤵
    PID:976
  - - C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe
      "C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\
      4⤵
      PID:2964
- - C:\Program Files\Common Files\System\backup.exe
    "C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\
    3⤵
    PID:1936
  - - C:\Program Files\Common Files\System\ado\backup.exe
      "C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\
      4⤵
      PID:1912
    - - C:\Program Files\Common Files\System\ado\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\
        5⤵
        
        PID:2748
    - - C:\Program Files\Common Files\System\ado\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\
        5⤵
        
        PID:824
      - C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\
        6⤵
        
        PID:2764
      - C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\
        6⤵
        
        PID:2708
      - C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\
        6⤵
        
        PID:896
      - C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe
        
        "C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\
        6⤵
        
        PID:1680
    - - C:\Program Files\Common Files\System\ado\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\
        5⤵
        
        PID:2812
    - - C:\Program Files\Common Files\System\ado\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\
        5⤵
        
        PID:2696
    - - C:\Program Files\Common Files\System\ado\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\
        5⤵
        
        PID:2580
  - - C:\Program Files\Common Files\System\de-DE\backup.exe
      "C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\
      4⤵
      PID:3028
  - - C:\Program Files\Common Files\System\en-US\backup.exe
      "C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\
      4⤵
      PID:3040
  - - C:\Program Files\Common Files\System\es-ES\backup.exe
      "C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\
      4⤵
      PID:2544
  - - C:\Program Files\Common Files\System\fr-FR\backup.exe
      "C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\
      4⤵
      PID:2596
  - - C:\Program Files\Common Files\System\it-IT\backup.exe
      "C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\
      4⤵
      PID:2880
  - - C:\Program Files\Common Files\System\msadc\backup.exe
      "C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\
      4⤵
      PID:1992
    - - C:\Program Files\Common Files\System\msadc\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\de-DE\backup.exe" C:\Program Files\Common Files\System\msadc\de-DE\
        5⤵
        
        PID:1996
    - - C:\Program Files\Common Files\System\msadc\en-US\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\en-US\backup.exe" C:\Program Files\Common Files\System\msadc\en-US\
        5⤵
        
        PID:1808
    - - C:\Program Files\Common Files\System\msadc\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\es-ES\backup.exe" C:\Program Files\Common Files\System\msadc\es-ES\
        5⤵
        
        PID:1664
    - - C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\fr-FR\backup.exe" C:\Program Files\Common Files\System\msadc\fr-FR\
        5⤵
        
        PID:2232
    - - C:\Program Files\Common Files\System\msadc\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\it-IT\backup.exe" C:\Program Files\Common Files\System\msadc\it-IT\
        5⤵
        
        PID:1772
    - - C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\msadc\ja-JP\backup.exe" C:\Program Files\Common Files\System\msadc\ja-JP\
        5⤵
        
        PID:296
  - - C:\Program Files\Common Files\System\Ole DB\backup.exe
      "C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\
      4⤵
      PID:1632
    - - C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\
        5⤵
        
        PID:1580
    - - C:\Program Files\Common Files\System\Ole DB\en-US\data.exe
        
        "C:\Program Files\Common Files\System\Ole DB\en-US\data.exe" C:\Program Files\Common Files\System\Ole DB\en-US\
        5⤵
        
        PID:1876
    - - C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\es-ES\backup.exe" C:\Program Files\Common Files\System\Ole DB\es-ES\
        5⤵
        
        PID:2908
    - - C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\fr-FR\backup.exe" C:\Program Files\Common Files\System\Ole DB\fr-FR\
        5⤵
        
        PID:1792
    - - C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\it-IT\backup.exe" C:\Program Files\Common Files\System\Ole DB\it-IT\
        5⤵
        
        PID:1088
    - - C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe
        
        "C:\Program Files\Common Files\System\Ole DB\ja-JP\backup.exe" C:\Program Files\Common Files\System\Ole DB\ja-JP\
        5⤵
        
        PID:2392
  - - C:\Program Files\Common Files\System\ja-JP\backup.exe
      "C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\
      4⤵
      PID:3004
- - C:\Program Files\Common Files\Services\backup.exe
    "C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\
    3⤵
    PID:2364
- - C:\Program Files\Common Files\Microsoft Shared\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\
    3⤵
    PID:2016
- C:\Program Files\DVD Maker\backup.exe
  "C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\
  2⤵
  PID:1780
- C:\Program Files\Google\backup.exe
  "C:\Program Files\Google\backup.exe" C:\Program Files\Google\
  2⤵
  PID:896
- - C:\Program Files\Google\Chrome\backup.exe
    "C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\
    3⤵
    PID:560
  - - C:\Program Files\Google\Chrome\Application\backup.exe
      "C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\
      4⤵
      PID:2488
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\
        5⤵
        
        PID:2780
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\
        6⤵
        
        PID:3060
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\update.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\update.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\
        6⤵
        
        PID:3024
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\
        6⤵
        
        PID:2352
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\
        6⤵
        
        PID:2860
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\
        6⤵
        
        PID:1344
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\backup.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\
        6⤵
        
        PID:2620
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\update.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\update.exe" C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\
        6⤵
        
        PID:3048
    - - C:\Program Files\Google\Chrome\Application\SetupMetrics\update.exe
        
        "C:\Program Files\Google\Chrome\Application\SetupMetrics\update.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\
        5⤵
        
        PID:1256
- C:\Program Files\7-Zip\backup.exe
  "C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\
  2⤵
  PID:760
- C:\Program Files\Internet Explorer\backup.exe
  "C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\
  2⤵
  PID:1904
- C:\Program Files\Java\backup.exe
  "C:\Program Files\Java\backup.exe" C:\Program Files\Java\
  2⤵
  PID:1096
- C:\Program Files\Microsoft Games\backup.exe
  "C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\
  2⤵
  PID:2112
- C:\Program Files\Microsoft Office\backup.exe
  "C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\
  2⤵
  PID:2808
- C:\Program Files\Mozilla Firefox\backup.exe
  "C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\
  2⤵
  PID:3060
- C:\Program Files\MSBuild\backup.exe
  "C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\
  2⤵
  PID:1092
- C:\Program Files\Reference Assemblies\update.exe
  "C:\Program Files\Reference Assemblies\update.exe" C:\Program Files\Reference Assemblies\
  2⤵
  PID:1580
- C:\Program Files\VideoLAN\backup.exe
  "C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\
  2⤵
  PID:1372
- C:\Program Files\Windows Defender\backup.exe
  "C:\Program Files\Windows Defender\backup.exe" C:\Program Files\Windows Defender\
  2⤵
  PID:2660
- C:\Program Files\Windows Journal\backup.exe
  "C:\Program Files\Windows Journal\backup.exe" C:\Program Files\Windows Journal\
  2⤵
  PID:1604

C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\
1⤵
PID:1152

C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\
1⤵
PID:1188

C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\
1⤵
PID:832

C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\
1⤵
PID:840

C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\
1⤵
PID:1480

C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\
1⤵
PID:756

C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\
1⤵
PID:2940

C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\
1⤵
PID:1596

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\
1⤵
PID:2140

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\
1⤵
PID:2568

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\
1⤵
PID:3028

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\
1⤵
PID:3040

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\
1⤵
PID:2584

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\
1⤵
PID:2876

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\
1⤵
PID:2828

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\
1⤵
PID:2932

C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\
1⤵
PID:2028

C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\
1⤵
PID:440

C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\
1⤵
PID:1648

C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\
1⤵
PID:460

C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\
1⤵
PID:1856

C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\
1⤵
PID:1968

C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\
1⤵
PID:760
- C:\Program Files\7-Zip\Lang\backup.exe
  "C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\
  2⤵
  PID:1860

C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\
1⤵
PID:1444

C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\
1⤵
PID:2980

C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\
1⤵
PID:1500

C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\
1⤵
PID:2248

C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\
1⤵
PID:2004

C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\
1⤵
PID:2052

C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\
1⤵
PID:488

C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\
1⤵
PID:2972

C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\
1⤵
PID:1384

C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\
1⤵
PID:1676

C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\
1⤵
PID:876

C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\data.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\
1⤵
PID:1708

C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\
1⤵
PID:2184

C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\
1⤵
PID:1912

C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\
1⤵
PID:1108

C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\
1⤵
PID:2776
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\
  2⤵
  PID:2688
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\
  2⤵
  PID:2952
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\
  2⤵
  PID:2676
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\
  2⤵
  PID:2140
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\
  2⤵
  PID:2888
- C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\
  2⤵
  PID:2608

C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\
1⤵
PID:1324
- C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\
  2⤵
  PID:2884

C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\
1⤵
PID:2876

C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe
"C:\Program Files\Common Files\Microsoft Shared\Stationery\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\
1⤵
PID:548

C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\
1⤵
PID:1716
- C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\
  2⤵
  PID:1092
- C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\
  2⤵
  PID:1348
- C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\
  2⤵
  PID:440
- C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\
  2⤵
  PID:1476
- C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\
  2⤵
  PID:2540
- C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\
  2⤵
  PID:1072

C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\
1⤵
PID:1372
- C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\
  2⤵
  PID:1652
- C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\
  2⤵
  PID:2660
- C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\
  2⤵
  PID:2432
- C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\
  2⤵
  PID:2968
- C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\
  2⤵
  PID:1132
- C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\
  2⤵
  PID:2284

C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\
1⤵
PID:2856

C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\
1⤵
PID:2032

C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\
1⤵
PID:1368

C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\
1⤵
PID:752
- C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\
  2⤵
  PID:1368

C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\
1⤵
PID:1384
- C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\
  2⤵
  PID:1684
- - C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe
    "C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\
    3⤵
    PID:2372

C:\Program Files\DVD Maker\de-DE\backup.exe
"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\
1⤵
PID:1604

C:\Program Files\DVD Maker\es-ES\backup.exe
"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\
1⤵
PID:1696

C:\Program Files\DVD Maker\fr-FR\backup.exe
"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\
1⤵
PID:2016
- C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\
  2⤵
  PID:1804
- C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\
  2⤵
  PID:824
- C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe
  "C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\
  2⤵
  PID:2968

C:\Program Files\DVD Maker\it-IT\backup.exe
"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\
1⤵
PID:832

C:\Program Files\DVD Maker\ja-JP\backup.exe
"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\
1⤵
PID:840

C:\Program Files\DVD Maker\Shared\backup.exe
"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\
1⤵
PID:564
- C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe
  "C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\
  2⤵
  PID:756
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\
    3⤵
    PID:2940
- - C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\
    3⤵
    PID:1552
- - C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\
    3⤵
    PID:2712
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\
    3⤵
    PID:2832
- - C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\
    3⤵
    PID:2772
- - C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\
    3⤵
    PID:2788
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\
    3⤵
    PID:2580
- - C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\
    3⤵
    PID:1912
  - - C:\Program Files\Common Files\System\ado\ja-JP\backup.exe
      "C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\
      4⤵
      PID:3060
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\
    3⤵
    PID:1352
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\
    3⤵
    PID:2864
- - C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\
    3⤵
    PID:3020
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\
    3⤵
    PID:1976
- - C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\
    3⤵
    PID:2164
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Push\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Push\
    3⤵
    PID:1816
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\
    3⤵
    PID:1884
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\
    3⤵
    PID:2960
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\
    3⤵
    PID:2824
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\
    3⤵
    PID:1732
- - C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\
    3⤵
    PID:2360
- - C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe
    "C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\
    3⤵
    PID:2128

C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\
1⤵
PID:1648
- C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\
  2⤵
  PID:2040
- C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\
  2⤵
  PID:1660
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\
    3⤵
    PID:1992
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\
    3⤵
    PID:2132
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\
    3⤵
    PID:2660
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\
    3⤵
    PID:2496
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\
      4⤵
      PID:2004
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\update.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\
    3⤵
    PID:2820
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\
    3⤵
    PID:1068
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\update.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\
      4⤵
      PID:2392
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\
    3⤵
    PID:1096
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\
    3⤵
    PID:1656
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\
      4⤵
      PID:1812
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\
        5⤵
        
        PID:1684
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\
      4⤵
      PID:1344
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\
        5⤵
        
        PID:2080
      - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\
        6⤵
        
        PID:2488
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\data.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\
      4⤵
      PID:2656
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\
        5⤵
        
        PID:2848
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\
      4⤵
      PID:2680
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\
        5⤵
        
        PID:2808
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\
    3⤵
    PID:2960
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prc\
      4⤵
      PID:2760
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\
    3⤵
    PID:2624
- - C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\
    3⤵
    PID:2872
- C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\
  2⤵
  PID:2860
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\
    3⤵
    PID:2924
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\
      4⤵
      PID:2864
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\
    3⤵
    PID:1092
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\
    3⤵
    PID:2100
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\
      4⤵
      PID:440
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\
      4⤵
      PID:1856
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\
        5⤵
        
        PID:1772
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\
        6⤵
        
        PID:1716
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\SaslPrep\
    3⤵
    PID:2024
- - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\System Restore.exe
    "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\
    3⤵
    PID:1932
  - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe
      "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\
      4⤵
      PID:2660
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\ICU\
        5⤵
        
        PID:2968
    - - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\
        5⤵
        
        PID:1636
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\
        6⤵
        
        PID:1044
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\
        6⤵
        
        PID:1188
      - C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe
        
        "C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\
        6⤵
        
        PID:1068
- C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe
  "C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\
  2⤵
  PID:752

C:\Program Files (x86)\Adobe\backup.exe
"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\
1⤵
PID:1184

C:\Program Files (x86)\backup.exe
"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\
1⤵
PID:3056
- C:\Program Files (x86)\Common Files\backup.exe
  "C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\
  2⤵
  PID:1752
- - C:\Program Files (x86)\Common Files\Adobe\backup.exe
    "C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\
    3⤵
    PID:1560
  - - C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Acrobat\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Acrobat\
      4⤵
      PID:2116
  - - C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Help\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\
      4⤵
      PID:2952
    - - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\
        5⤵
        
        PID:2476
      - C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\
        6⤵
        
        PID:548
        
        C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe
        
        "C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Help\en_US\Adobe Reader\9.0\
        7⤵
        
        PID:440
  - - C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe
      "C:\Program Files (x86)\Common Files\Adobe\Updater6\backup.exe" C:\Program Files (x86)\Common Files\Adobe\Updater6\
      4⤵
      PID:2296
- - C:\Program Files (x86)\Common Files\Adobe AIR\update.exe
    "C:\Program Files (x86)\Common Files\Adobe AIR\update.exe" C:\Program Files (x86)\Common Files\Adobe AIR\
    3⤵
    PID:1468
- - C:\Program Files (x86)\Common Files\DESIGNER\update.exe
    "C:\Program Files (x86)\Common Files\DESIGNER\update.exe" C:\Program Files (x86)\Common Files\DESIGNER\
    3⤵
    PID:1076
- - C:\Program Files (x86)\Common Files\microsoft shared\backup.exe
    "C:\Program Files (x86)\Common Files\microsoft shared\backup.exe" C:\Program Files (x86)\Common Files\microsoft shared\
    3⤵
    PID:2032
- - C:\Program Files (x86)\Common Files\Services\backup.exe
    "C:\Program Files (x86)\Common Files\Services\backup.exe" C:\Program Files (x86)\Common Files\Services\
    3⤵
    PID:2948
- - C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe
    "C:\Program Files (x86)\Common Files\SpeechEngines\backup.exe" C:\Program Files (x86)\Common Files\SpeechEngines\
    3⤵
    PID:1020
- - C:\Program Files (x86)\Common Files\System\backup.exe
    "C:\Program Files (x86)\Common Files\System\backup.exe" C:\Program Files (x86)\Common Files\System\
    3⤵
    PID:1908
- C:\Program Files (x86)\Google\backup.exe
  "C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\
  2⤵
  PID:1952
- - C:\Program Files (x86)\Google\CrashReports\backup.exe
    "C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\
    3⤵
    PID:2152
- - C:\Program Files (x86)\Google\Temp\backup.exe
    "C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\
    3⤵
    PID:1336
- - C:\Program Files (x86)\Google\Update\System Restore.exe
    "C:\Program Files (x86)\Google\Update\System Restore.exe" C:\Program Files (x86)\Google\Update\
    3⤵
    PID:2984
- C:\Program Files (x86)\Internet Explorer\backup.exe
  "C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft Analysis Services\backup.exe
  "C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft Office\backup.exe
  "C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft SQL Server Compact Edition\data.exe
  "C:\Program Files (x86)\Microsoft SQL Server Compact Edition\data.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft Sync Framework\backup.exe
  "C:\Program Files (x86)\Microsoft Sync Framework\backup.exe" C:\Program Files (x86)\Microsoft Sync Framework\
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe
  "C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe
  "C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft.NET\backup.exe
  "C:\Program Files (x86)\Microsoft.NET\backup.exe" C:\Program Files (x86)\Microsoft.NET\
  2⤵
  PID:2152
- C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe
  "C:\Program Files (x86)\Mozilla Maintenance Service\backup.exe" C:\Program Files (x86)\Mozilla Maintenance Service\
  2⤵
  PID:872

C:\Program Files\DVD Maker\en-US\backup.exe
"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\
1⤵
PID:1212

C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe
"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\
1⤵
PID:2816

C:\PerfLogs\Admin\backup.exe
C:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\
1⤵
PID:1348

C:\PerfLogs\backup.exe
C:\PerfLogs\backup.exe C:\PerfLogs\
1⤵
PID:2480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\Admin\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
C:\PerfLogs\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
C:\PerfLogs\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
C:\Program Files\7-Zip\Lang\backup.exe

Filesize
84KB

MD5
be206195bcf1930178232f170b56323c

SHA1
d3256b00cdef801fb3336bf00d6aa457e8ae664d

SHA256
aea9e806f594b17de94894b05ad3ce559ed255f030ff1be26f3fc6a0788fc16d

SHA512
91540d0a872d212e67b58aa512d1490fb8bbc9e662676bc6687054aead684af4e13ddfc69e8ed05b8008513d8d33866cbd29c2f4d8900fb238155d967a06e719

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
C:\Program Files\7-Zip\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
84KB

MD5
f57afdfe7b049b18edae4f690ecd10a3

SHA1
ddb3cedcb687f28d7ddeea1898bdc53726157d7d

SHA256
5e04bac49aab1fc378cc943afee909dd23d01d376145bf321d527ed1524ad4ac

SHA512
60359648c42e10b9748d5fc4ff6671793bda57f500144f5b3e78c75aa45d46133b3b0d0e7090ae01a72cf516944180bc8175819ac365f71eb8b1e4cea8615768

Download Submit
C:\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
84KB

MD5
f57afdfe7b049b18edae4f690ecd10a3

SHA1
ddb3cedcb687f28d7ddeea1898bdc53726157d7d

SHA256
5e04bac49aab1fc378cc943afee909dd23d01d376145bf321d527ed1524ad4ac

SHA512
60359648c42e10b9748d5fc4ff6671793bda57f500144f5b3e78c75aa45d46133b3b0d0e7090ae01a72cf516944180bc8175819ac365f71eb8b1e4cea8615768

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
84KB

MD5
032b8dc92a9e6e198db6050ea9a9a879

SHA1
d01d5d6e1b79cd8a6f213b752d65cfd76f353355

SHA256
cc0b78bb3acd65567e1806b330864cf56f6941b7b47a3a2c52a6aa22097be2eb

SHA512
5cd6c94466fea1f59c55ee02b7716caa269b7e17bc43135bd3242028f5da3fc85881988d4f3091b1568f5abbf6844988ddecfd3373954c1eb41c5008d1d2a567

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

Filesize
84KB

MD5
032b8dc92a9e6e198db6050ea9a9a879

SHA1
d01d5d6e1b79cd8a6f213b752d65cfd76f353355

SHA256
cc0b78bb3acd65567e1806b330864cf56f6941b7b47a3a2c52a6aa22097be2eb

SHA512
5cd6c94466fea1f59c55ee02b7716caa269b7e17bc43135bd3242028f5da3fc85881988d4f3091b1568f5abbf6844988ddecfd3373954c1eb41c5008d1d2a567

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
84KB

MD5
7ac122fcb3aee2d71d702f2d9c2e3933

SHA1
b8fa52376fb810b13efec2e08bd134fc37d4f4b8

SHA256
f79f9e88a42c8b3eae4ffde7d345227331dca41f8290c98fbed47d08e459ed54

SHA512
c858cc9ffdef157e1c8851d5528f2a3ab090ffd91d70947c2d5c2643ba98104eb50850fc8ef09c145843601b9f746d0c1158ea7b8e766011e4c7f9265ba1385b

Download Submit
C:\Program Files\Common Files\backup.exe

Filesize
84KB

MD5
7ac122fcb3aee2d71d702f2d9c2e3933

SHA1
b8fa52376fb810b13efec2e08bd134fc37d4f4b8

SHA256
f79f9e88a42c8b3eae4ffde7d345227331dca41f8290c98fbed47d08e459ed54

SHA512
c858cc9ffdef157e1c8851d5528f2a3ab090ffd91d70947c2d5c2643ba98104eb50850fc8ef09c145843601b9f746d0c1158ea7b8e766011e4c7f9265ba1385b

Download Submit
C:\Program Files\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
C:\Program Files\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\3213833178\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3213833178\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\3213833178\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
84KB

MD5
cacdc90d7726a976a3c64cc29f543f52

SHA1
922ea99c82ddcc173fb2552cec22ae009fb4ae57

SHA256
2a2b973e6ab5f099231847f5a5684df513163cca4b566275fe4fe0ab46e967f3

SHA512
05c4326d2937d680c76d3e024ae8d0330c54878065b43811d798835de23ed1a58fd0cb097e0184a133561a7f00ddb0fd1254bc301b9a614b17fb6bda03dd4a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

Filesize
84KB

MD5
cacdc90d7726a976a3c64cc29f543f52

SHA1
922ea99c82ddcc173fb2552cec22ae009fb4ae57

SHA256
2a2b973e6ab5f099231847f5a5684df513163cca4b566275fe4fe0ab46e967f3

SHA512
05c4326d2937d680c76d3e024ae8d0330c54878065b43811d798835de23ed1a58fd0cb097e0184a133561a7f00ddb0fd1254bc301b9a614b17fb6bda03dd4a87

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
22B

MD5
76cdb2bad9582d23c1f6f4d868218d6c

SHA1
b04f3ee8f5e43fa3b162981b50bb72fe1acabb33

SHA256
8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85

SHA512
5e2f959f36b66df0580a94f384c5fc1ceeec4b2a3925f062d7b68f21758b86581ac2adcfdde73a171a28496e758ef1b23ca4951c05455cdae9357cc3b5a5825f

Download Submit
C:\Users\Admin\AppData\Local\Temp\temp.zip

Filesize
30KB

MD5
c6a3256c9deb0666adf3f45fe229b57e

SHA1
7f85d55acb16ee9ef963570161fd0888dd0f50cd

SHA256
64eafb078315bd68415e723be6fd48b468747e234e5856c2dd4299f6776c53e3

SHA512
b9e1b33a65fef90c6fe111c407751ccce02a5d91ae4996ebe6d5e31931efaf69d7493b8dc3cb0426eb52702ead10b8944e1e15e5215df8564211180b8e971455

Download Submit
C:\backup.exe

Filesize
84KB

MD5
dfc501b84df4a1dc297f9ed819221371

SHA1
e0c69082e41d9880097381bf25885e75da1393a4

SHA256
153128389bf062bc8926b177fd3d7c89d2d40217510a0d6e526045d6e7693fbe

SHA512
2e3e5df1d4b11d1804b5d94b4d4d35bc57263822898f6cf356056c497a8b39a57306a4f0d02b2e7778ffecf24f78d800a9d6a5c72f1f4476961b11f1afef8cff

Download Submit
C:\backup.exe

Filesize
84KB

MD5
dfc501b84df4a1dc297f9ed819221371

SHA1
e0c69082e41d9880097381bf25885e75da1393a4

SHA256
153128389bf062bc8926b177fd3d7c89d2d40217510a0d6e526045d6e7693fbe

SHA512
2e3e5df1d4b11d1804b5d94b4d4d35bc57263822898f6cf356056c497a8b39a57306a4f0d02b2e7778ffecf24f78d800a9d6a5c72f1f4476961b11f1afef8cff

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
\PerfLogs\Admin\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
\PerfLogs\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
\PerfLogs\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
84KB

MD5
be206195bcf1930178232f170b56323c

SHA1
d3256b00cdef801fb3336bf00d6aa457e8ae664d

SHA256
aea9e806f594b17de94894b05ad3ce559ed255f030ff1be26f3fc6a0788fc16d

SHA512
91540d0a872d212e67b58aa512d1490fb8bbc9e662676bc6687054aead684af4e13ddfc69e8ed05b8008513d8d33866cbd29c2f4d8900fb238155d967a06e719

Download Submit
\Program Files\7-Zip\Lang\backup.exe

Filesize
84KB

MD5
be206195bcf1930178232f170b56323c

SHA1
d3256b00cdef801fb3336bf00d6aa457e8ae664d

SHA256
aea9e806f594b17de94894b05ad3ce559ed255f030ff1be26f3fc6a0788fc16d

SHA512
91540d0a872d212e67b58aa512d1490fb8bbc9e662676bc6687054aead684af4e13ddfc69e8ed05b8008513d8d33866cbd29c2f4d8900fb238155d967a06e719

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
\Program Files\7-Zip\backup.exe

Filesize
84KB

MD5
3c70f53a5c32d79692335691ec3cae2b

SHA1
8d9bcb2c3896e2de0410a34bfca21640b654f859

SHA256
57f318c6d1ca7bfdb9d3471be465f702dea33ce6abf6fa25d1edb34d98ed3319

SHA512
adf46be7b7a2e402c0dc374a1605b0bc9045a84451d9dd1b70a805052270c64ee728bcbdb62090195d10cd4af3e335cb28293df60fc61f7ac463f735fe80fa8d

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
\Program Files\Common Files\Microsoft Shared\Filters\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
84KB

MD5
f57afdfe7b049b18edae4f690ecd10a3

SHA1
ddb3cedcb687f28d7ddeea1898bdc53726157d7d

SHA256
5e04bac49aab1fc378cc943afee909dd23d01d376145bf321d527ed1524ad4ac

SHA512
60359648c42e10b9748d5fc4ff6671793bda57f500144f5b3e78c75aa45d46133b3b0d0e7090ae01a72cf516944180bc8175819ac365f71eb8b1e4cea8615768

Download Submit
\Program Files\Common Files\Microsoft Shared\backup.exe

Filesize
84KB

MD5
f57afdfe7b049b18edae4f690ecd10a3

SHA1
ddb3cedcb687f28d7ddeea1898bdc53726157d7d

SHA256
5e04bac49aab1fc378cc943afee909dd23d01d376145bf321d527ed1524ad4ac

SHA512
60359648c42e10b9748d5fc4ff6671793bda57f500144f5b3e78c75aa45d46133b3b0d0e7090ae01a72cf516944180bc8175819ac365f71eb8b1e4cea8615768

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
84KB

MD5
032b8dc92a9e6e198db6050ea9a9a879

SHA1
d01d5d6e1b79cd8a6f213b752d65cfd76f353355

SHA256
cc0b78bb3acd65567e1806b330864cf56f6941b7b47a3a2c52a6aa22097be2eb

SHA512
5cd6c94466fea1f59c55ee02b7716caa269b7e17bc43135bd3242028f5da3fc85881988d4f3091b1568f5abbf6844988ddecfd3373954c1eb41c5008d1d2a567

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe

Filesize
84KB

MD5
032b8dc92a9e6e198db6050ea9a9a879

SHA1
d01d5d6e1b79cd8a6f213b752d65cfd76f353355

SHA256
cc0b78bb3acd65567e1806b330864cf56f6941b7b47a3a2c52a6aa22097be2eb

SHA512
5cd6c94466fea1f59c55ee02b7716caa269b7e17bc43135bd3242028f5da3fc85881988d4f3091b1568f5abbf6844988ddecfd3373954c1eb41c5008d1d2a567

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\backup.exe

Filesize
84KB

MD5
7c00b0c85fc6fe317f3e128c2d9f2fd6

SHA1
c1feae619c73247e73fd52b497e464804d4cf6d7

SHA256
0c96e25d58ba5db5b4ff742e742ae334a4d7d4258f1dd37824936497ce81f1b4

SHA512
fede9c632605050ca14882a93787ac52bdae9630530454e460f33f3ce4eb4d4fdd7aab58155538bbdf31547d8e1345e35d04035ae601c61cfd82854cf7aa3788

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

Filesize
84KB

MD5
032b8dc92a9e6e198db6050ea9a9a879

SHA1
d01d5d6e1b79cd8a6f213b752d65cfd76f353355

SHA256
cc0b78bb3acd65567e1806b330864cf56f6941b7b47a3a2c52a6aa22097be2eb

SHA512
5cd6c94466fea1f59c55ee02b7716caa269b7e17bc43135bd3242028f5da3fc85881988d4f3091b1568f5abbf6844988ddecfd3373954c1eb41c5008d1d2a567

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe

Filesize
84KB

MD5
032b8dc92a9e6e198db6050ea9a9a879

SHA1
d01d5d6e1b79cd8a6f213b752d65cfd76f353355

SHA256
cc0b78bb3acd65567e1806b330864cf56f6941b7b47a3a2c52a6aa22097be2eb

SHA512
5cd6c94466fea1f59c55ee02b7716caa269b7e17bc43135bd3242028f5da3fc85881988d4f3091b1568f5abbf6844988ddecfd3373954c1eb41c5008d1d2a567

Download Submit
\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe

Filesize
84KB

MD5
7d7befeda78b20b43eb9774cbf2eb366

SHA1
31187276ba76336db12f1b615ad704ea5cb2070e

SHA256
05f424eacea0b4f5ed11f5ed54ea40f910839332984aa26f1b55960c28e0d1e7

SHA512
c82fe28cc942479c8ec141735678b02174c3595739db44afaaa849b82886da0075e0cc2dd63651a7f77aacb11b9b0973192c7ad1fc8a50a1155746644da24c19

Download Submit
\Program Files\Common Files\backup.exe

Filesize
84KB

MD5
7ac122fcb3aee2d71d702f2d9c2e3933

SHA1
b8fa52376fb810b13efec2e08bd134fc37d4f4b8

SHA256
f79f9e88a42c8b3eae4ffde7d345227331dca41f8290c98fbed47d08e459ed54

SHA512
c858cc9ffdef157e1c8851d5528f2a3ab090ffd91d70947c2d5c2643ba98104eb50850fc8ef09c145843601b9f746d0c1158ea7b8e766011e4c7f9265ba1385b

Download Submit
\Program Files\Common Files\backup.exe

Filesize
84KB

MD5
7ac122fcb3aee2d71d702f2d9c2e3933

SHA1
b8fa52376fb810b13efec2e08bd134fc37d4f4b8

SHA256
f79f9e88a42c8b3eae4ffde7d345227331dca41f8290c98fbed47d08e459ed54

SHA512
c858cc9ffdef157e1c8851d5528f2a3ab090ffd91d70947c2d5c2643ba98104eb50850fc8ef09c145843601b9f746d0c1158ea7b8e766011e4c7f9265ba1385b

Download Submit
\Program Files\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
\Program Files\backup.exe

Filesize
84KB

MD5
352d4f6404ddd58efbe54283f81e36cc

SHA1
904e52daa450706c8b0586125b4a7781c08d8a72

SHA256
2b9f52241de3c2644c7957a107663d889ab74a825b22dcf2f1e3ad430572dafc

SHA512
61fc3020a81249a8175bbace7bbaf628f1f8f9c5ec00ce4d6a6d3b4a4d633065436c4d71cf4ca59a60c85b3fccfc82e6c2d97da4d9649a24694f4aadda0e85c2

Download Submit
\Users\Admin\AppData\Local\Temp\3213833178\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\3213833178\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\Low\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
84KB

MD5
cacdc90d7726a976a3c64cc29f543f52

SHA1
922ea99c82ddcc173fb2552cec22ae009fb4ae57

SHA256
2a2b973e6ab5f099231847f5a5684df513163cca4b566275fe4fe0ab46e967f3

SHA512
05c4326d2937d680c76d3e024ae8d0330c54878065b43811d798835de23ed1a58fd0cb097e0184a133561a7f00ddb0fd1254bc301b9a614b17fb6bda03dd4a87

Download Submit
\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe

Filesize
84KB

MD5
cacdc90d7726a976a3c64cc29f543f52

SHA1
922ea99c82ddcc173fb2552cec22ae009fb4ae57

SHA256
2a2b973e6ab5f099231847f5a5684df513163cca4b566275fe4fe0ab46e967f3

SHA512
05c4326d2937d680c76d3e024ae8d0330c54878065b43811d798835de23ed1a58fd0cb097e0184a133561a7f00ddb0fd1254bc301b9a614b17fb6bda03dd4a87

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe

Filesize
84KB

MD5
8a4be579226f37804aed270da77828dd

SHA1
fc3b174d16c9f3d03853208e9c79b7b400086d80

SHA256
ceede9931415af37c66104cfb4fd70e315e727e06766d53f07c65c922b3f6c37

SHA512
4579898816a3b49b40bd6ad5dcab5051ee95e92e383e1f1d0eb535216e53f92a59f56fd05b976643d78f05ab8dc7d14fa5f05af30dde7453caa1a3c94a7573c0

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

Filesize
84KB

MD5
cacdc90d7726a976a3c64cc29f543f52

SHA1
922ea99c82ddcc173fb2552cec22ae009fb4ae57

SHA256
2a2b973e6ab5f099231847f5a5684df513163cca4b566275fe4fe0ab46e967f3

SHA512
05c4326d2937d680c76d3e024ae8d0330c54878065b43811d798835de23ed1a58fd0cb097e0184a133561a7f00ddb0fd1254bc301b9a614b17fb6bda03dd4a87

Download Submit
\Users\Admin\AppData\Local\Temp\mozilla-temp-files\data.exe

Filesize
84KB

MD5
cacdc90d7726a976a3c64cc29f543f52

SHA1
922ea99c82ddcc173fb2552cec22ae009fb4ae57

SHA256
2a2b973e6ab5f099231847f5a5684df513163cca4b566275fe4fe0ab46e967f3

SHA512
05c4326d2937d680c76d3e024ae8d0330c54878065b43811d798835de23ed1a58fd0cb097e0184a133561a7f00ddb0fd1254bc301b9a614b17fb6bda03dd4a87

Download Submit
memory/112-207-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/112-186-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/112-160-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/112-194-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/112-199-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/112-224-0x00000000003C0000-0x00000000003DC000-memory.dmp

Filesize
112KB

Download
memory/320-249-0x0000000000270000-0x000000000028C000-memory.dmp

Filesize
112KB

Download
memory/320-236-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/664-174-0x0000000000320000-0x000000000033C000-memory.dmp

Filesize
112KB

Download
memory/664-162-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/664-121-0x0000000000320000-0x000000000033C000-memory.dmp

Filesize
112KB

Download
memory/756-313-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/760-179-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/824-370-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/824-250-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/824-272-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/824-344-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/824-334-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/824-335-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/824-270-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/840-296-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/896-281-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1152-243-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1188-255-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1348-146-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1480-305-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1596-329-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1680-263-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1740-76-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1860-177-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2016-269-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/2016-226-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/2016-253-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2096-83-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2096-21-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2096-135-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2096-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2096-84-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2096-91-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2096-45-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2096-148-0x0000000002680000-0x0000000002681000-memory.dmp

Filesize
4KB

Download
memory/2096-46-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2096-58-0x00000000003E0000-0x00000000003FC000-memory.dmp

Filesize
112KB

Download
memory/2104-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2104-155-0x0000000000280000-0x000000000029C000-memory.dmp

Filesize
112KB

Download
memory/2140-365-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2140-50-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2480-134-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download
memory/2480-132-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download
memory/2480-139-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2568-374-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2692-23-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2692-27-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2708-339-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2764-369-0x00000000002E0000-0x00000000002FC000-memory.dmp

Filesize
112KB

Download
memory/2764-352-0x00000000002E0000-0x00000000002FC000-memory.dmp

Filesize
112KB

Download
memory/2764-379-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2804-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2816-356-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2820-77-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2940-320-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2968-217-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3028-383-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3032-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads